From 0bb0da96fa55933ed9ef93fa65fde644b6a04de2 Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Wed, 26 Jul 2023 17:47:55 -0700 Subject: [PATCH 01/40] Change Job Ordering/Make Single Job/Prevent X on main (#628) --- .github/workflows/rule-validate.yml | 75 ++++++++--------------------- 1 file changed, 20 insertions(+), 55 deletions(-) diff --git a/.github/workflows/rule-validate.yml b/.github/workflows/rule-validate.yml index c34ed7ce5ea..1cda761759f 100644 --- a/.github/workflows/rule-validate.yml +++ b/.github/workflows/rule-validate.yml @@ -15,6 +15,9 @@ jobs: tests: name: Run Rule Validation runs-on: ubuntu-20.04 + permissions: + contents: write + checks: write steps: - name: Set up yq @@ -26,6 +29,16 @@ jobs: ref: ${{ github.head_ref }} repository: ${{ github.event.pull_request.head.repo.full_name }} + - uses: actions/setup-python@v4 + with: + python-version: '3.10' + + - name: Add Rule IDs as Needed & Check for Duplicates + # Run before testing, just in case this could invalidate the rule itself + run: | + pip install -r scripts/generate-rule-ids/requirements.txt + python scripts/generate-rule-ids/main.py + - name: Validate Rules run: | for f in *-rules/*.yml @@ -58,30 +71,6 @@ jobs: run: | ! /bin/sh -c 'ls **/*.yaml' - rule-ids: - name: Add Rule IDs & Validate Uniqueness - runs-on: ubuntu-20.04 - - permissions: - contents: write - - steps: - - name: Checkout - uses: actions/checkout@v3 - with: - ref: ${{ github.head_ref }} - repository: ${{ github.event.pull_request.head.repo.full_name }} - fetch-depth: 0 - - - uses: actions/setup-python@v4 - with: - python-version: '3.10' - - - name: Add Rule IDs as Needed & Check for Duplicates - run: | - pip install -r scripts/generate-rule-ids/requirements.txt - python scripts/generate-rule-ids/main.py - - name: Commit & Push Results, if needed run: | if [ -z "$(git status --porcelain)" ]; then @@ -95,41 +84,17 @@ jobs: git commit -m "Auto add rule ID" git push origin ${{ github.head_ref }} - - name: Get the head ref (eg branch) - id: get_head - run: git rev-parse HEAD > sha.txt - - - name: Upload SHA for later job - uses: actions/upload-artifact@v3 - with: - name: sha - path: sha.txt - - # When the rule-ids job adds a commit, GitHub won't trigger actions on the auto commit. Various alternatives - # were explored, but all run into issues when dealing with forks (well we'll see if this does too). - set-checks: - name: Set GH Checks Status - runs-on: ubuntu-20.04 - # Both must complete successfully. We assume that rule-ids does not break our rule validation (if we're not confident - # we can change the ordering. - needs: [rule-ids, tests] - - permissions: - checks: write - - steps: - - - name: Download SHA from Previous Job - uses: actions/download-artifact@v3 - with: - name: sha - - - name: Get the head ref (eg branch) + - name: Get the head SHA id: get_head - run: echo "##[set-output name=HEAD;]$(cat sha.txt)" + run: echo "##[set-output name=HEAD;]$(git rev-parse HEAD)" + # When we add a commit, GitHub won't trigger actions on the auto commit, so we're missing a required check on the + # HEAD commit. + # Various alternatives were explored, but all run into issues when dealing with forks. This sets a "Check" for + # the latest commit, and we can depend on that as a required check. - name: "Create a check run" uses: actions/github-script@v6 + if: github.event_name == 'pull_request_target' env: parameter_url: '${{ github.event.pull_request.html_url }}' with: From 11cb6f2d9105f9ff77b03c9b599d831fa70ab670 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Fri, 28 Jul 2023 11:04:54 -0700 Subject: [PATCH 02/40] Updating Rule: Editing header check (#631) Co-authored-by: ID Generator --- detection-rules/link_fake_thread_nlu_financial_request.yml | 5 ++++- response.txt | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 response.txt diff --git a/detection-rules/link_fake_thread_nlu_financial_request.yml b/detection-rules/link_fake_thread_nlu_financial_request.yml index d36a6240d66..25bbfac199f 100644 --- a/detection-rules/link_fake_thread_nlu_financial_request.yml +++ b/detection-rules/link_fake_thread_nlu_financial_request.yml @@ -23,7 +23,10 @@ source: | length(headers.references) == 0 and headers.in_reply_to is null ) - or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To"))) + or ( + not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To"))) + and not any(headers.hops, strings.ilike(.signature.headers, "*:reply-to")) + ) ) // sender's domain is not in body, and body has > 0 links diff --git a/response.txt b/response.txt new file mode 100644 index 00000000000..cf6230dcc00 --- /dev/null +++ b/response.txt @@ -0,0 +1 @@ +{"functions":["length"],"list":["recipient_domains"]} From 29f532792fffb1247b2acf0793164dc0e956c304 Mon Sep 17 00:00:00 2001 From: Josh Kamdjou Date: Sun, 30 Jul 2023 23:02:02 -0400 Subject: [PATCH 03/40] New rule - URI protocol handler: search-ms (#635) --- detection-rules/uri_handler_search_ms.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 detection-rules/uri_handler_search_ms.yml diff --git a/detection-rules/uri_handler_search_ms.yml b/detection-rules/uri_handler_search_ms.yml new file mode 100644 index 00000000000..6c9b796840c --- /dev/null +++ b/detection-rules/uri_handler_search_ms.yml @@ -0,0 +1,23 @@ +name: "URI protocol handler: search-ms" +description: | + Detects HTML attachments using the search-ms URI protocol handler, + a technique observed ITW to deliver malicious payloads. + + This rule can be updated to analyze links in PDF attachments and message bodies +references: + - "https://twitter.com/blackorbird/status/1684505999301029888?s=20" +type: "rule" +severity: "high" +source: | + type.inbound + and any(attachments, .file_type == "html" + and any(file.explode(.), + any(.scan.strings.strings, + regex.contains(., 'search-ms:query.*location:\\\\') + ) + ) + ) +tags: + - "Suspicious attachment" + - "Malware" +id: "ee27d9c0-2d7e-5f6d-85be-73f3bf5b7cb1" From 4c958d00892386b51372591f8c4d04de27f682f4 Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Mon, 31 Jul 2023 09:37:44 -0700 Subject: [PATCH 04/40] Use updated CI check name (#636) --- .github/workflows/update-test-rules.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-test-rules.yml b/.github/workflows/update-test-rules.yml index efd52c86991..289cf8ac5cb 100644 --- a/.github/workflows/update-test-rules.yml +++ b/.github/workflows/update-test-rules.yml @@ -51,7 +51,7 @@ jobs: uses: lewagon/wait-on-check-action@v1.3.1 with: ref: ${{ steps.comment-branch.outputs.head_sha }} - check-name: 'Run Rule Validation' + check-name: 'Rule Tests and ID Generation' repo-token: ${{ secrets.GITHUB_TOKEN }} wait-interval: 10 From c8a6f7bb1a2b6b7074b693f0623f8db1a024ea8c Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 31 Jul 2023 09:43:50 -0700 Subject: [PATCH 05/40] Updating Rule: Switching to credphish (#610) Co-authored-by: Sam Scholten Co-authored-by: Cameron Dunn Co-authored-by: ID Generator --- detection-rules/attachment_eml_cred_theft.yml | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/detection-rules/attachment_eml_cred_theft.yml b/detection-rules/attachment_eml_cred_theft.yml index 4d63e828e19..31cdc787634 100644 --- a/detection-rules/attachment_eml_cred_theft.yml +++ b/detection-rules/attachment_eml_cred_theft.yml @@ -1,6 +1,6 @@ name: "Attachment: EML with link to credential phishing page" description: | - Attached EML contains a link which uses language resembling credential phishing. + Attached EML links to a credential phishing site. type: "rule" severity: "medium" source: | @@ -12,18 +12,10 @@ source: | .domain.domain in $free_file_hosts or .domain.root_domain in $free_subdomain_hosts ) - and any(.scan.url.urls, - // another option is using credphish disposition, - // we're just waiting on an update to flag Adobe on indd[.]adobe[.]com - any(file.explode(beta.linkanalysis(.).screenshot), - any(ml.nlu_classifier(.scan.ocr.raw).intents, - .name == "cred_theft" and - .confidence == "high" - ) - ) + beta.linkanalysis(.).credphish.disposition == "phishing" ) - ) + ) ) // engaging language in the original body @@ -39,6 +31,6 @@ source: | tags: - "Suspicious attachment" - "Suspicious link" - - "Natural Language Understanding" + - "Computer Vision" - "Credential phishing" id: "1df41cca-369a-5bff-83cc-0f9ddf1ff007" From 8a6b0ae4ee80d8c0fd7dac82bf91c641de37d648 Mon Sep 17 00:00:00 2001 From: Josh Kamdjou Date: Mon, 31 Jul 2023 13:49:30 -0400 Subject: [PATCH 06/40] New rule - Brand impersonation: Microsoft Teams (#617) --- .../impersonation_microsoft_teams.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 detection-rules/impersonation_microsoft_teams.yml diff --git a/detection-rules/impersonation_microsoft_teams.yml b/detection-rules/impersonation_microsoft_teams.yml new file mode 100644 index 00000000000..60eb376829e --- /dev/null +++ b/detection-rules/impersonation_microsoft_teams.yml @@ -0,0 +1,17 @@ +name: "Brand impersonation: Microsoft Teams" +description: | + Impersonation of a Microsoft Teams message. +type: "rule" +severity: "high" +source: | + type.inbound + and any(attachments, + .file_type in ("pdf", "jpg", "jpeg", "png") + and any(file.explode(.), + regex.icontains(.scan.ocr.raw, "trying to reach you.*microsoft teams") + ) + ) + and sender.email.domain.root_domain not in ("microsoft.com", "microsoftsupport.com", "office.com") +tags: + - "Brand impersonation" +id: "9cd53055-8e1a-5a45-b78f-34a62f0793dd" From 3474121e59b9da54b0fa4f16011297c420546bc6 Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Tue, 1 Aug 2023 11:18:07 -0700 Subject: [PATCH 07/40] Fix check name, and make title/etc consistent (#638) --- .github/workflows/rule-validate.yml | 6 +++--- .github/workflows/update-test-rules.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/rule-validate.yml b/.github/workflows/rule-validate.yml index 1cda761759f..7e434ee6bab 100644 --- a/.github/workflows/rule-validate.yml +++ b/.github/workflows/rule-validate.yml @@ -112,8 +112,8 @@ jobs: conclusion: "success", details_url: process.env.parameter_url, output: { - title: "Rule Tests and ID Generation", - summary: "Rule Tests and ID Generation", - text: "Rule Tests and ID Generation", + title: "Rule Tests and ID Updated", + summary: "Rule Tests and ID Updated", + text: "Rule Tests and ID Updated", }, }); diff --git a/.github/workflows/update-test-rules.yml b/.github/workflows/update-test-rules.yml index 289cf8ac5cb..89c681c27e0 100644 --- a/.github/workflows/update-test-rules.yml +++ b/.github/workflows/update-test-rules.yml @@ -51,7 +51,7 @@ jobs: uses: lewagon/wait-on-check-action@v1.3.1 with: ref: ${{ steps.comment-branch.outputs.head_sha }} - check-name: 'Rule Tests and ID Generation' + check-name: 'Rule Tests and ID Updated' repo-token: ${{ secrets.GITHUB_TOKEN }} wait-interval: 10 From e1b0687361953c39f396a24c01d233de6d702ae5 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Wed, 2 Aug 2023 07:59:46 -0700 Subject: [PATCH 08/40] New rule (Brand impersonation): Amazon with suspicious attachment (#606) Co-authored-by: Cameron Dunn Co-authored-by: ID Generator Co-authored-by: Sam Scholten --- .../impersonation_amazon_suspicious_text.yml | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 detection-rules/impersonation_amazon_suspicious_text.yml diff --git a/detection-rules/impersonation_amazon_suspicious_text.yml b/detection-rules/impersonation_amazon_suspicious_text.yml new file mode 100644 index 00000000000..70be5908e8f --- /dev/null +++ b/detection-rules/impersonation_amazon_suspicious_text.yml @@ -0,0 +1,67 @@ +name: "Brand impersonation: Amazon with suspicious attachment" +description: | + Impersonation of Amazon. These are most commonly fake shipping notifications. + Amazon is the #2 most-impersonated brand (as of Q2 2020) +references: + - "https://www.pcmag.com/news/google-and-amazon-are-impersonated-the-most-in-phishing-scams" + - "https://sellercentral.amazon.com/gp/help/external/32261?language=en-US" +type: "rule" +severity: "medium" +source: | + type.inbound + and strings.ilike(sender.display_name, "amazon*") + and any(attachments, .file_type in ("pdf", "jpg", "jpeg", "png") + and any(ml.logo_detect(.).brands, + .name == "Amazon" and .confidence in~ ("medium", "high") + ) + and ( + any(file.explode(.), + any(ml.nlu_classifier(.scan.ocr.raw).intents, + .name != "benign" and .confidence == "high" + ) + ) + or any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, + .name != "benign" and .confidence == "high" + ) + ) + ) + // unsolicited + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $recipient_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $recipient_domains + ) + ) + and sender.email.domain.root_domain not in~ ( + 'amazon.com', + 'amazon.com.au', + 'amazon.co.uk', + 'amazon.de', + 'amazon.es', + 'amazon.fr', + 'amazon.it', + 'amazon.in', + 'amazon.lu', + 'amazon.com.au', + 'amazonsellerservices.com', + 'amazon.ae', + 'amazon.sa', + 'amazon.cn', + 'amazon.ca', + 'amazon.com.mx', + 'amazon.com.br', + 'amazon.sg', + 'amazon.com.tr', + 'amazonpay.in', + 'amazonpay.com', + 'synchronybank.com', + ) +tags: + - "Brand impersonation" + - "Suspicious sender" + - "Suspicious attachment" +id: "5751dcb9-071d-540b-9ec3-410d6aa80c11" From a64cc0df4cdae62e5ff6788c0c5c0950d7cced0e Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Wed, 2 Aug 2023 11:08:30 -0700 Subject: [PATCH 09/40] Only commit yml file changes (#639) --- .github/workflows/rule-validate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rule-validate.yml b/.github/workflows/rule-validate.yml index 7e434ee6bab..7c494087690 100644 --- a/.github/workflows/rule-validate.yml +++ b/.github/workflows/rule-validate.yml @@ -80,7 +80,7 @@ jobs: git config user.name 'ID Generator' git config user.email 'hello@sublimesecurity.com' - git add -A + git add **/*.yml git commit -m "Auto add rule ID" git push origin ${{ github.head_ref }} From 68e8474fba315851264f3fbc7f7aa3cf39fc1468 Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Wed, 2 Aug 2023 11:23:25 -0700 Subject: [PATCH 10/40] Just Delete response.txt (#640) --- .github/workflows/rule-validate.yml | 2 ++ response.txt | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/rule-validate.yml b/.github/workflows/rule-validate.yml index 7c494087690..a5b0a727660 100644 --- a/.github/workflows/rule-validate.yml +++ b/.github/workflows/rule-validate.yml @@ -73,6 +73,8 @@ jobs: - name: Commit & Push Results, if needed run: | + rm response.txt + if [ -z "$(git status --porcelain)" ]; then echo "No files changed, nothing to do" exit 0 diff --git a/response.txt b/response.txt index cf6230dcc00..e69de29bb2d 100644 --- a/response.txt +++ b/response.txt @@ -1 +0,0 @@ -{"functions":["length"],"list":["recipient_domains"]} From e05eef8d4baf02edb31cc8479e1068bdb6ff503e Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Wed, 2 Aug 2023 13:43:06 -0700 Subject: [PATCH 11/40] Delete response.txt (bad merge before?) (#643) --- response.txt | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 response.txt diff --git a/response.txt b/response.txt deleted file mode 100644 index e69de29bb2d..00000000000 From dd5f3573f119020091ca8231bc1c25f2f209c0f6 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Thu, 3 Aug 2023 16:34:10 -0400 Subject: [PATCH 12/40] New Rule: Google Accelerated Mobile Pages (AMP) abuse (#644) Co-authored-by: ID Generator Co-authored-by: Josh Kamdjou --- .../link_google_amp_suspicious_indicators.yml | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 detection-rules/link_google_amp_suspicious_indicators.yml diff --git a/detection-rules/link_google_amp_suspicious_indicators.yml b/detection-rules/link_google_amp_suspicious_indicators.yml new file mode 100644 index 00000000000..a0a361cfaf2 --- /dev/null +++ b/detection-rules/link_google_amp_suspicious_indicators.yml @@ -0,0 +1,56 @@ +name: "Google Accelerated Mobile Pages (AMP) abuse" +description: | + This rule is designed to identify phishing attempts abusing Google AMP's URL structure for malicious activities. + The rule aims to detect specific URL patterns, further analyzing both message content, as well as the destination of the link to distinguish + between legitimate Google AMP pages and potential malicious usage. +references: + - "https://cofense.com/blog/google-amp-the-newest-of-evasive-phishing-tactic/" +type: "rule" +severity: "medium" +source: | + type.inbound + + // Any body links with a domain SLD of 'google' and a path starting with /amp/s + and any(body.links, + .href_url.domain.sld == "google" + and strings.starts_with(.href_url.path, "/amp/s/") + + // Brand Logo detected that is not google + and ( + any(ml.logo_detect(beta.message_screenshot()).brands, + .name is not null and .name != "Google" + ) + + // or the page has a login or captcha + or ( + beta.linkanalysis(.).credphish.contains_login + or beta.linkanalysis(.).credphish.contains_captcha + ) + + // or linkanalysis concludes phishing of medium to high confidence + or any([beta.linkanalysis(.)], + .credphish.disposition == "phishing" + and .credphish.brand.confidence in ("medium", "high") + ) + + // or NLU detected cred theft on the landing page + or any(file.explode(beta.linkanalysis(.).screenshot), + any(ml.nlu_classifier(.scan.ocr.raw).intents, + .name == "cred_theft" and .confidence in ("medium", "high") + ) + + // captcha partially loaded + or strings.icontains(.scan.ocr.raw, "Checking if the site connection is secure") + ) + + // or the link display text contains "password" + or strings.icontains(.display_text, "password") + + // or the link contains the recipients email in the url path + or any(recipients.to, strings.icontains(..href_url.path, .email.email)) + ) + ) +tags: + - "Open redirect" + - "Credential phishing" +id: "46907029-ef83-50a8-9198-75af39dd5f3b" From 1006e363627c23b933ecf2bc0791117202447900 Mon Sep 17 00:00:00 2001 From: Josh Kamdjou Date: Thu, 3 Aug 2023 18:20:14 -0400 Subject: [PATCH 13/40] New rule - Spam: URL shortener with short body content and emojis (#630) Co-authored-by: ID Generator Co-authored-by: Cameron Dunn Co-authored-by: Sam Scholten --- detection-rules/spam_url_shortener_emojis.yml | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 detection-rules/spam_url_shortener_emojis.yml diff --git a/detection-rules/spam_url_shortener_emojis.yml b/detection-rules/spam_url_shortener_emojis.yml new file mode 100644 index 00000000000..dfc0a6c7d1b --- /dev/null +++ b/detection-rules/spam_url_shortener_emojis.yml @@ -0,0 +1,40 @@ +name: "Spam: URL shortener with short body content and emojis" +type: "rule" +description: | + Detects spam from freemail senders, where the majority of the body is a URL shortener and emojis. +source: | + type.inbound + + // sender is a freemail + and sender.email.domain.root_domain in $free_email_providers + + // has a URL shortener + and any(body.links, + .href_url.domain.root_domain in $url_shorteners + ) + + // short body, basically just the URL + and length(body.plain.raw) < 100 + + // has an emoji in the subject or body + and ( + regex.contains(body.plain.raw, '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]') + or regex.contains(subject.subject, '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]') + + ) + + // first-time sender + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) + ) +severity: "low" +tags: + - "Spam" +id: "b7797e4c-f2d7-5330-8a16-7123fe9bb6a8" From 07eb419c73874c84635b98fa69411887d8e7a569 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Thu, 3 Aug 2023 18:22:06 -0400 Subject: [PATCH 14/40] Update attachment_vba_macro_auto_exec_unsolicited.yml (#633) Co-authored-by: ID Generator Co-authored-by: Cameron Dunn --- .../attachment_vba_macro_auto_exec_unsolicited.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/detection-rules/attachment_vba_macro_auto_exec_unsolicited.yml b/detection-rules/attachment_vba_macro_auto_exec_unsolicited.yml index 888f76a77b7..2a0b19bab79 100644 --- a/detection-rules/attachment_vba_macro_auto_exec_unsolicited.yml +++ b/detection-rules/attachment_vba_macro_auto_exec_unsolicited.yml @@ -23,6 +23,12 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) + + // negate replies + and ( + length(headers.references) == 0 + or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To"))) + ) tags: - "Suspicious attachment" - "Macros" From 9f7802e20c3616b066adda9aa595277328b85cda Mon Sep 17 00:00:00 2001 From: Josh Kamdjou Date: Fri, 4 Aug 2023 01:13:49 -0400 Subject: [PATCH 15/40] New rule - Credential phishing: 'Secure message' and engaging language (#616) Co-authored-by: Cameron Dunn Co-authored-by: ID Generator Co-authored-by: Sam Scholten --- ...ink_credential_phishing_secure_message.yml | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 detection-rules/link_credential_phishing_secure_message.yml diff --git a/detection-rules/link_credential_phishing_secure_message.yml b/detection-rules/link_credential_phishing_secure_message.yml new file mode 100644 index 00000000000..b9a8687d81c --- /dev/null +++ b/detection-rules/link_credential_phishing_secure_message.yml @@ -0,0 +1,38 @@ +name: "Credential phishing: 'Secure message' and engaging language" +description: | + Body contains language resembling credential theft, and a "secure message" from a first-time sender. +type: "rule" +severity: "medium" +source: | + type.inbound + + and any(ml.nlu_classifier(body.current_thread.text).intents, + .name == "cred_theft" and .confidence == "high" + ) + + // ----- other suspicious signals here ----- + and strings.icontains(body.html.display_text, "secure message") + + // todo: automated display name / human local part + // todo: suspicious link (unfurl click trackers) + + // ---------- + + // has at least 1 link + and length(body.links) > 0 + + // first-time sender + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) + ) +tags: + - "Natural Language Understanding" + - "Credential phishing" +id: "bd95a7b1-dc96-53c1-bb7c-3a0f98b04744" From b3fa2dae6f90e34efb42f93985c911318c182f25 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Tue, 8 Aug 2023 23:04:12 -0400 Subject: [PATCH 16/40] Mass update: attack_types,detection_methods, tactics & techniques (#649) Co-authored-by: Josh Kamdjou --- .../attachment_adobe_image_lure_fts.yml | 16 ++- ...chment_any_html_in_archive_unsolicited.yml | 10 +- .../attachment_any_html_new_sender.yml | 5 +- .../attachment_any_html_unsolicited.yml | 6 +- .../attachment_archive_with_chm.yml | 10 +- .../attachment_archive_with_exe.yml | 11 +- ...chive_with_pdf_wsf_txt_attached.qakbot.yml | 11 +- .../attachment_callback_phish_with_img.yml | 19 +++- .../attachment_callback_phish_with_pdf.yml | 18 +++- .../attachment_cve_2023_21716_rtf_fonts.yml | 10 +- ...chment_disallowed_file_type_in_archive.yml | 8 +- ...chment_docusign_image_suspicious_links.yml | 15 ++- ...achment_dropbox_image_suspicious_links.yml | 16 ++- detection-rules/attachment_eicar.yml | 6 +- detection-rules/attachment_eml_cred_theft.yml | 20 +++- .../attachment_eml_file_with_ipfs_links.yml | 18 ++-- .../attachment_eml_html_attachment_portal.yml | 17 ++- ...ttachment_eml_suspicious_link_language.yml | 16 ++- .../attachment_eml_with_html_attachment.yml | 13 ++- ...hment_emotet_heavily_padded_doc_in_zip.yml | 13 ++- .../attachment_encrypted_ole_unsolicited.yml | 14 ++- .../attachment_excel_web_query_file_iqy.yml | 10 +- .../attachment_filename_with_unicode_rtlo.yml | 9 +- ...ree_subdomain_suspicious_link_language.yml | 14 ++- .../attachment_html_attachment_login_page.yml | 14 ++- .../attachment_html_excessive_padding.yml | 10 +- ...tachment_html_recipients_suspicious_js.yml | 14 ++- .../attachment_html_smuggling_atob.yml | 14 ++- ...ment_html_smuggling_auto_file_download.yml | 14 ++- ...ml_smuggling_concatenation_obfuscation.yml | 12 ++- ...ment_html_smuggling_double_encoded_zip.yml | 100 ++++++++++-------- ...chment_html_smuggling_embedded_b64_iso.yml | 18 +++- ...achment_html_smuggling_embedded_b64_pe.yml | 17 ++- ...muggling_embedded_base64_file_download.yml | 13 ++- .../attachment_html_smuggling_entropy.yml | 12 ++- .../attachment_html_smuggling_eval_atob.yml | 14 ++- ...html_smuggling_fromcharcode_and_others.yml | 14 ++- .../attachment_html_smuggling_hex_strings.yml | 12 ++- .../attachment_html_smuggling_location.yml | 14 ++- ...chment_html_smuggling_microsoft_signin.yml | 16 ++- .../attachment_html_smuggling_raw_buffer.yml | 12 ++- .../attachment_html_smuggling_rc4.yml | 14 ++- .../attachment_html_smuggling_rot13.yml | 15 ++- .../attachment_html_smuggling_settimeout.yml | 14 ++- .../attachment_html_smuggling_unescape.yml | 13 ++- .../attachment_ics_embedded_document.yml | 8 +- ...link_to_executable_suspicious_language.yml | 9 +- .../attachment_js_file_execution.yml | 11 +- detection-rules/attachment_lnk_file.yml | 9 +- ...achment_lnk_file_with_embedded_content.yml | 13 ++- .../attachment_macro_dll_loader.yml | 14 ++- .../attachment_malicious_onenote_commands.yml | 13 ++- detection-rules/attachment_malwarebazaar.yml | 14 +-- .../attachment_mht_embedded_vbscript.yml | 13 ++- ...ttachment_microsoft_image_lure_qr_code.yml | 13 ++- detection-rules/attachment_msi_installer.yml | 11 +- .../attachment_office365_image.yml | 13 ++- .../attachment_office_file_with_vsto.yml | 13 ++- .../attachment_office_remote_doc_template.yml | 9 +- ...ent_pdf_credtheft_link_suspicious_file.yml | 16 ++- ...ile_fraudulent_cryptocurrency_exchange.yml | 33 ++++-- ...achment_pdf_file_with_embedded_content.yml | 10 +- ...pdf_linking_to_password_protected_file.yml | 67 +++++++----- ...attachment_pdf_with_google_ae_redirect.yml | 13 ++- ...nt_pdf_with_link_to_zip_containing_wsf.yml | 15 ++- ...ow_reputation_link_to_suspicious_files.yml | 13 ++- ...f_with_low_reputation_link_to_zip_file.yml | 14 ++- ...tential_sandbox_evasion_in_office_file.yml | 10 +- .../attachment_powershell_content.yml | 9 +- .../attachment_rdp_connection_file.yml | 8 +- .../attachment_rtf_embedded_content.yml | 9 +- detection-rules/attachment_sfx_commands.yml | 9 +- ...shellbrowserwindow_com_object_in_macro.yml | 11 +- .../attachment_soliciting_enable_macros.yml | 11 +- ...suspicious_vba_macro_first_time_sender.yml | 10 +- .../attachment_svg_embedded_js.yml | 12 ++- .../attachment_svg_file_execution.yml | 11 +- .../attachment_uncommon_compressed.yml | 12 ++- .../attachment_url_with_unc_path.yml | 10 +- ...chment_vba_macro_auto_exec_unsolicited.yml | 16 ++- ...chment_vba_macro_auto_open_unsolicited.yml | 10 +- ...ttachment_vba_macro_calling_executable.yml | 9 +- ...hment_vba_macro_employee_impersonation.yml | 17 +-- .../attachment_vba_macro_high_risk.yml | 10 +- ...achment_with_encrypted_zip_unsolicited.yml | 11 +- ...ent_with_suspicious_author_unsolicited.yml | 7 +- ...with_unknown_encrypted_zip_unsolicited.yml | 12 ++- ...y_business_email_compromise_new_sender.yml | 14 ++- ..._business_email_compromise_unsolicited.yml | 17 +-- .../body_callback_phishing_no_attachment.yml | 13 ++- detection-rules/body_extortion.yml | 18 ++-- ...y_html_callback_phishing_no_attachment.yml | 70 ++++++------ .../body_html_smuggling_atob_in_body.yml | 11 +- detection-rules/body_job_scam_new_sender.yml | 15 +-- .../body_microsoft_logo_bing_redirect.yml | 23 ++-- .../body_unicode_slashes_in_url.yml | 10 +- ...lback_phishing_nlu_body_or_attachments.yml | 16 ++- .../cve_2021_40444_external_relationship.yml | 14 ++- .../disposable_sender_unsolicited.yml | 4 +- ...ing_link_from_suspicious_sender_domain.yml | 13 ++- .../file_sharing_link_suspicious_subject.yml | 13 ++- detection-rules/headers_anonymousfox.yml | 9 +- ...d_recipients_no_links_freemail_replyto.yml | 20 ++-- ...s_freemail_replyto_returnpath_mismatch.yml | 13 ++- detection-rules/headers_invalid_ios_build.yml | 11 +- ...ailer_with_common_phishing_attachments.yml | 9 +- ...headers_replyto_new_domain_nlu_request.yml | 13 ++- .../headers_russia_return_path.yml | 10 +- .../headers_sendgrid_onmicrosoft.yml | 8 +- detection-rules/headers_spf_temp_error.yml | 6 +- .../headers_voicemail_sendgrid.yml | 9 +- ..._zimbra_mailer_unsupported_os_versions.yml | 4 +- detection-rules/impersonation_adp.yml | 11 +- detection-rules/impersonation_amazon.yml | 11 +- .../impersonation_amazon_suspicious_text.yml | 16 ++- detection-rules/impersonation_amex.yml | 12 ++- detection-rules/impersonation_apple.yml | 11 +- .../impersonation_bank_of_america.yml | 12 ++- detection-rules/impersonation_barracuda.yml | 12 ++- detection-rules/impersonation_binance.yml | 17 ++- detection-rules/impersonation_blockchain.yml | 12 ++- detection-rules/impersonation_chase.yml | 12 ++- detection-rules/impersonation_coinbase.yml | 12 ++- detection-rules/impersonation_dhl.yml | 12 ++- .../impersonation_digital_ocean.yml | 12 ++- detection-rules/impersonation_docusign.yml | 14 ++- ...o_freemail_lookalike_financial_request.yml | 13 ++- detection-rules/impersonation_dropbox.yml | 13 ++- .../impersonation_employee_payroll_fraud.yml | 14 ++- .../impersonation_employee_subject.yml | 15 +-- .../impersonation_employee_urgent_request.yml | 17 +-- detection-rules/impersonation_exodus.yml | 10 +- detection-rules/impersonation_facebook.yml | 12 ++- ...hread_mismatched_from_freemail_replyto.yml | 76 +++++++------ ...personation_fake_shipping_notification.yml | 13 ++- detection-rules/impersonation_fedex.yml | 12 ++- detection-rules/impersonation_finra.yml | 12 ++- detection-rules/impersonation_github.yml | 12 ++- .../impersonation_google_via_msft_forms.yml | 13 ++- detection-rules/impersonation_gusto.yml | 14 ++- .../impersonation_human_resources.yml | 21 ++-- detection-rules/impersonation_ledger.yml | 11 +- detection-rules/impersonation_linkedin.yml | 12 ++- detection-rules/impersonation_microsoft.yml | 19 ++-- .../impersonation_microsoft_quarantine.yml | 16 ++- .../impersonation_microsoft_teams.yml | 14 ++- detection-rules/impersonation_netflix.yml | 12 ++- .../impersonation_norton_lifelock.yml | 14 ++- detection-rules/impersonation_outlook.yml | 12 ++- detection-rules/impersonation_paypal.yml | 15 ++- .../impersonation_recipient_domain.yml | 11 +- ...tion_recipient_sld_in_sender_local_fts.yml | 12 ++- detection-rules/impersonation_ripple.yml | 8 +- ...ation_sharepoint_body_credential_theft.yml | 13 ++- ...tion_sharepoint_image_credential_theft.yml | 14 ++- .../impersonation_siliconvalleybank.yml | 11 +- detection-rules/impersonation_spotify.yml | 11 +- detection-rules/impersonation_stellar.yml | 8 +- .../impersonation_sublime_security.yml | 13 ++- detection-rules/impersonation_turbotax.yml | 11 +- detection-rules/impersonation_twitter.yml | 11 +- detection-rules/impersonation_ukr_net.yml | 11 +- detection-rules/impersonation_ups.yml | 11 +- detection-rules/impersonation_vanta.yml | 11 +- detection-rules/impersonation_venmo.yml | 11 +- .../impersonation_vip_urgent_request.yml | 18 ++-- detection-rules/impersonation_wells_fargo.yml | 12 ++- detection-rules/impersonation_zoom_strict.yml | 10 +- detection-rules/inline_image_as_message.yml | 12 ++- .../link_coinbase_low_rep_or_shortened.yml | 20 ++-- .../link_contains_punycode_characters.yml | 11 +- detection-rules/link_credential_phishing.yml | 13 ++- ...l_phishing_intent_and_other_indicators.yml | 13 ++- ...link_credential_phishing_language_ipfs.yml | 12 ++- ...ink_credential_phishing_secure_message.yml | 8 +- ...hing_suspicious_sender_tld_and_signals.yml | 12 ++- ...credential_phishing_voicemail_language.yml | 12 ++- detection-rules/link_deactivated_bitly.yml | 8 +- ...k_download_disk_image_in_encrypted_zip.yml | 91 +++++++++------- .../link_download_suspicious_file.yml | 18 +++- detection-rules/link_dynamics_form.yml | 12 ++- ...link_fake_thread_nlu_financial_request.yml | 15 ++- .../link_firebase_new_domain_redirect.yml | 10 +- .../link_google_amp_suspicious_indicators.yml | 19 +++- .../link_google_apps_script_macro.yml | 10 +- .../link_google_comment_script_macro.yml | 12 ++- detection-rules/link_google_translate.yml | 9 +- ...ink_html_smuggling_with_adobe_branding.yml | 17 ++- ...l_smuggling_with_google_drive_branding.yml | 19 ++-- ..._fake_customer_service_freemail_sender.yml | 15 ++- detection-rules/link_ipfs_phishing.yml | 17 ++- detection-rules/link_login_or_captcha.yml | 16 ++- .../link_microsoft_device_code_phish.yml | 11 +- ...link_microsoft_go2_open_redirect_phish.yml | 11 +- ...crosoft_impersonation_using_hosted_png.yml | 14 ++- .../link_microsoft_low_reputation.yml | 19 +++- ...k_new_domain_in_link_first_time_sender.yml | 9 +- detection-rules/link_notion_file_share.yml | 13 ++- ...office365_suspicious_app_authorization.yml | 6 +- .../link_outlook_left_to_right_exploit.yml | 12 ++- .../link_qr_code_suspicious_language_fts.yml | 23 ++-- ...e_multiple_recipients_from_outside_org.yml | 14 ++- .../link_undisclosed_recipients_credphish.yml | 11 +- detection-rules/lookalike_sender_domain.yml | 10 +- detection-rules/malformed_url_prefix.yml | 11 +- ..._campaign_recipient_address_new_sender.yml | 11 +- detection-rules/open_redirect_atdmt.yml | 9 +- detection-rules/open_redirect_avast.yml | 9 +- detection-rules/open_redirect_bmwusa.yml | 9 +- .../open_redirect_googleweblight.yml | 10 +- detection-rules/open_redirect_hhs.yml | 10 +- detection-rules/open_redirect_linkedin.yml | 10 +- detection-rules/open_redirect_mcgill.yml | 9 +- detection-rules/open_redirect_msn.yml | 9 +- .../open_redirect_panera_bread.yml | 10 +- detection-rules/open_redirect_samsung.yml | 10 +- detection-rules/open_redirect_slack.yml | 10 +- detection-rules/open_redirect_snapchat.yml | 10 +- .../open_redirect_ticketmaster.yml | 9 +- detection-rules/open_redirect_vk.yml | 9 +- detection-rules/open_redirect_youtube.yml | 10 +- detection-rules/paypal_invoice_abuse.yml | 75 +++++++------ detection-rules/punycode_sender_domain.yml | 12 ++- .../recipients_undisclosed_compauth_check.yml | 10 +- ...pients_undisclosed_free_subdomain_host.yml | 10 +- ...disclosed_nlu_cred_theft_low_rep_links.yml | 17 +-- ...nder_new_from_domain_first_time_sender.yml | 5 +- ...n_excessive_display_text_with_keywords.yml | 17 +-- ...ve_space_obfuscation_free_file_hosting.yml | 9 +- detection-rules/spam_url_shortener_emojis.yml | 12 ++- detection-rules/spoof_dropbox.yml | 12 ++- ...ble_internal_domain_suspicious_signals.yml | 14 ++- detection-rules/stripe_invoice_abuse.yml | 11 +- ...ious_request_for_quote_html_smuggling.yml} | 19 ++-- ...spicious_request_for_quote_or_purchase.yml | 15 +-- ...oint_file_share_undisclosed_recipients.yml | 14 ++- .../suspicious_shipping_notification.yml | 15 ++- detection-rules/uri_handler_search_ms.yml | 10 +- .../urlhaus_malicious_dom_in_body_or_pdf.yml | 14 ++- ...impersonation_attack_surface_reduction.yml | 81 +++++++------- 240 files changed, 2487 insertions(+), 981 deletions(-) rename detection-rules/{suspicious_request_for_quote_html_smuggling.yml.yml => suspicious_request_for_quote_html_smuggling.yml} (92%) diff --git a/detection-rules/attachment_adobe_image_lure_fts.yml b/detection-rules/attachment_adobe_image_lure_fts.yml index 3691e0bdf96..1d84a92ff8c 100644 --- a/detection-rules/attachment_adobe_image_lure_fts.yml +++ b/detection-rules/attachment_adobe_image_lure_fts.yml @@ -1,6 +1,5 @@ name: "Attachment: Adobe image lure with suspicious link from first time sender" -description: "Detects Adobe phishing messages with an Adobe logo attached, with suspicious link language - from a first-time sender." +description: "Detects Adobe phishing messages with an Adobe logo attached, with suspicious link language from a first-time sender." type: "rule" severity: "medium" source: | @@ -25,8 +24,15 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Suspicious link" - - "Brand impersonation" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Image as content" + - "Impersonation: Brand" +detection_methods: + - "Content analysis" - "Computer Vision" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" id: "1d7add81-9822-576a-bcae-c4440e75e393" diff --git a/detection-rules/attachment_any_html_in_archive_unsolicited.yml b/detection-rules/attachment_any_html_in_archive_unsolicited.yml index 682806f5dc5..95bd7734acc 100644 --- a/detection-rules/attachment_any_html_in_archive_unsolicited.yml +++ b/detection-rules/attachment_any_html_in_archive_unsolicited.yml @@ -25,6 +25,14 @@ source: | ) ) tags: - - "Suspicious attachment" - "Attack surface reduction" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "HTML smuggling" +detection_methods: + - "Archive analysis" + - "File analysis" id: "6a67c02c-d405-531e-850a-1722849c5fe4" diff --git a/detection-rules/attachment_any_html_new_sender.yml b/detection-rules/attachment_any_html_new_sender.yml index 3a0dd481a41..17aedb1ff72 100644 --- a/detection-rules/attachment_any_html_new_sender.yml +++ b/detection-rules/attachment_any_html_new_sender.yml @@ -27,7 +27,10 @@ source: | ) ) tags: - - "Suspicious attachment" - "Attack surface reduction" +tactics_and_techniques: - "HTML smuggling" +detection_methods: + - "HTML analysis" + - "Sender analysis" id: "57a8f5c5-c4c4-5268-b452-e381dc64ea42" diff --git a/detection-rules/attachment_any_html_unsolicited.yml b/detection-rules/attachment_any_html_unsolicited.yml index fe0b39cbd13..80527bfd3c1 100644 --- a/detection-rules/attachment_any_html_unsolicited.yml +++ b/detection-rules/attachment_any_html_unsolicited.yml @@ -27,7 +27,11 @@ source: | ) ) tags: - - "Suspicious attachment" - "Attack surface reduction" +tactics_and_techniques: - "HTML smuggling" +detection_methods: + - "File analysis" + - "HTML analysis" + - "Sender analysis" id: "ef36763f-917d-5338-b1ac-84047334dce8" diff --git a/detection-rules/attachment_archive_with_chm.yml b/detection-rules/attachment_archive_with_chm.yml index df9c8df125c..926e3f7e0be 100644 --- a/detection-rules/attachment_archive_with_chm.yml +++ b/detection-rules/attachment_archive_with_chm.yml @@ -14,7 +14,11 @@ source: | and any(attachments, .file_extension in~ $file_extensions_common_archives and any(file.explode(.), .file_extension =~ "chm") ) -tags: - - "Suspicious attachment" - - "Malware" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Archive analysis" + - "File analysis" id: "5280e94d-592b-5d80-b548-b0e2ad4c9eae" diff --git a/detection-rules/attachment_archive_with_exe.yml b/detection-rules/attachment_archive_with_exe.yml index 8ca7adbc3a9..24101b3a289 100644 --- a/detection-rules/attachment_archive_with_exe.yml +++ b/detection-rules/attachment_archive_with_exe.yml @@ -19,7 +19,12 @@ source: | any(.flavors.yara, . == "mz_file") ) ) -tags: - - "Suspicious attachment" - - "Malware" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Archive analysis" + - "File analysis" + - "YARA" id: "e2b0ad86-1264-567e-b7c4-78d7ddbe7722" diff --git a/detection-rules/attachment_archive_with_pdf_wsf_txt_attached.qakbot.yml b/detection-rules/attachment_archive_with_pdf_wsf_txt_attached.qakbot.yml index ace4dcc07e5..f3cc147ff46 100644 --- a/detection-rules/attachment_archive_with_pdf_wsf_txt_attached.qakbot.yml +++ b/detection-rules/attachment_archive_with_pdf_wsf_txt_attached.qakbot.yml @@ -15,6 +15,13 @@ source: | and any(file.explode(.), .depth == 1 and .file_extension == "wsf") ) tags: - - "QakBot" - - "Suspicious attachment" + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "PDF" +detection_methods: + - "Archive analysis" + - "File analysis" id: "16b2e239-a7d1-51ef-aac1-562b3cc59787" diff --git a/detection-rules/attachment_callback_phish_with_img.yml b/detection-rules/attachment_callback_phish_with_img.yml index 11ad1403e23..29ad847fe58 100644 --- a/detection-rules/attachment_callback_phish_with_img.yml +++ b/detection-rules/attachment_callback_phish_with_img.yml @@ -19,7 +19,7 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) - + and sender.email.domain.root_domain in $free_email_providers and any(attachments, .file_extension in~ ('png', 'jpg', 'jpeg') and any(file.explode(.), @@ -39,7 +39,7 @@ source: | "*refund*", "*+1*" ))) >= 4) - + and any(file.explode(.), length(filter(.scan.strings.strings, strings.ilike(., "*geek squad*", @@ -52,7 +52,18 @@ source: | "*secure anywhere*" ))) >=1) ) -tags: +attack_types: - "Callback Phishing" - - "Customer service fraud" +tactics_and_techniques: + - "Evasion" + - "Free email provider" + - "Out of band pivot" + - "Social engineering" + - "Image as content" +detection_methods: + - "Content analysis" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" + - "Computer Vision" id: "60acbb36-8ed1-562e-8027-260c2fdf0f04" diff --git a/detection-rules/attachment_callback_phish_with_pdf.yml b/detection-rules/attachment_callback_phish_with_pdf.yml index 580f9c80641..c951fafcf30 100644 --- a/detection-rules/attachment_callback_phish_with_pdf.yml +++ b/detection-rules/attachment_callback_phish_with_pdf.yml @@ -23,7 +23,7 @@ source: | // sender is freemail and sender.email.domain.root_domain in $free_email_providers - + // the attachment is a pdf with 1 page, and at least 60 ocr chars and any(attachments, .file_extension == "pdf" and any(file.explode(.), @@ -47,7 +47,7 @@ source: | "*refund*", "*+1*" ))) >= 4) - + // 1 of the following strings is found, representing common Callback brands and any(file.explode(.), length(filter(.scan.strings.strings, strings.ilike(., @@ -60,7 +60,17 @@ source: | "*paypal*", ))) >=1) ) -tags: +attack_types: - "Callback Phishing" - - "Customer service fraud" +tactics_and_techniques: + - "Evasion" + - "Free email provider" + - "Out of band pivot" + - "PDF" + - "Social engineering" +detection_methods: + - "Exif analysis" + - "File analysis" + - "Optical Character Recognition" + - "Sender analysis" id: "ac33f097-af20-554c-b29a-56f21be1b285" diff --git a/detection-rules/attachment_cve_2023_21716_rtf_fonts.yml b/detection-rules/attachment_cve_2023_21716_rtf_fonts.yml index 3806b56d0aa..4158d855436 100644 --- a/detection-rules/attachment_cve_2023_21716_rtf_fonts.yml +++ b/detection-rules/attachment_cve_2023_21716_rtf_fonts.yml @@ -21,7 +21,11 @@ source: | and length(filter(.scan.strings.strings, strings.ilike(.,'{\f*;}'))) > 10000 ) ) -tags: - - "Office exploit" - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Exploit" +detection_methods: + - "Content analysis" + - "File analysis" id: "23714cca-f0c6-5fa5-a68b-98c9d60a508d" diff --git a/detection-rules/attachment_disallowed_file_type_in_archive.yml b/detection-rules/attachment_disallowed_file_type_in_archive.yml index ec4161c0f79..fdfb6213a46 100644 --- a/detection-rules/attachment_disallowed_file_type_in_archive.yml +++ b/detection-rules/attachment_disallowed_file_type_in_archive.yml @@ -194,6 +194,12 @@ source: | ) ) tags: - - "Suspicious attachment" - "Attack surface reduction" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Archive analysis" + - "File analysis" id: "3859e3e7-51c9-5259-9b7d-f8c0957696c0" diff --git a/detection-rules/attachment_docusign_image_suspicious_links.yml b/detection-rules/attachment_docusign_image_suspicious_links.yml index 057ce4705bd..76e6ca214fc 100644 --- a/detection-rules/attachment_docusign_image_suspicious_links.yml +++ b/detection-rules/attachment_docusign_image_suspicious_links.yml @@ -28,8 +28,17 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Suspicious link" - - "Brand impersonation" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: - "Computer Vision" + - "Content analysis" + - "Header analysis" + - "Natural Language Understanding" + - "Optical Character Recognition" + - "Sender analysis" + - "URL screenshot" id: "814a5694-d626-5bf4-a1ba-a1dbcb625279" diff --git a/detection-rules/attachment_dropbox_image_suspicious_links.yml b/detection-rules/attachment_dropbox_image_suspicious_links.yml index 5de6896143a..77bed727988 100644 --- a/detection-rules/attachment_dropbox_image_suspicious_links.yml +++ b/detection-rules/attachment_dropbox_image_suspicious_links.yml @@ -6,7 +6,7 @@ source: | type.inbound and length(filter(attachments, .file_type not in~ ('png', 'jpeg', 'jpg', 'bmp'))) == 0 and any(body.links, not strings.ilike(.href_url.domain.root_domain, "dropbox.*")) - + and any(attachments, .file_type in~ ('png','jpg','jpeg','bmp') and any(file.explode(.), any(.scan.strings.strings, strings.ilike(., "*dropbox*")) @@ -24,7 +24,15 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Suspicious link" - - "Brand impersonation" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Optical Character Recognition" + - "Sender analysis" id: "500eee2d-d793-5450-a87f-825ce27c897d" diff --git a/detection-rules/attachment_eicar.yml b/detection-rules/attachment_eicar.yml index a8e90fbb65c..0ca141f4953 100644 --- a/detection-rules/attachment_eicar.yml +++ b/detection-rules/attachment_eicar.yml @@ -1,7 +1,7 @@ name: "Attachment: EICAR String Present" description: | This rule detects the EICAR test string, used to evaluate Anti-Virus scanning and file inspection capabilities. - + For performance reasons, this rule is limited to attachments with "eicar" in the file name. references: - "https://www.eicar.org/download-anti-malware-testfile/" @@ -18,4 +18,8 @@ source: | )) tags: - "EICAR" +attack_types: + - "Malware/Ransomware" +detection_methods: + - "File analysis" id: "592e2319-9e4f-5e3d-9b34-22259ddc3416" diff --git a/detection-rules/attachment_eml_cred_theft.yml b/detection-rules/attachment_eml_cred_theft.yml index 31cdc787634..88e8063435f 100644 --- a/detection-rules/attachment_eml_cred_theft.yml +++ b/detection-rules/attachment_eml_cred_theft.yml @@ -28,9 +28,21 @@ source: | and not any(headers.references, strings.contains(body.html.display_text, .) ) -tags: - - "Suspicious attachment" - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Free file host" + - "Free subdomain host" + - "Social engineering" +detection_methods: - "Computer Vision" - - "Credential phishing" + - "Content analysis" + - "File analysis" + - "Header analysis" + - "HTML analysis" + - "Natural Language Understanding" + - "Optical Character Recognition" + - "URL analysis" + - "URL screenshot" id: "1df41cca-369a-5bff-83cc-0f9ddf1ff007" diff --git a/detection-rules/attachment_eml_file_with_ipfs_links.yml b/detection-rules/attachment_eml_file_with_ipfs_links.yml index ced2a638495..2797732d568 100644 --- a/detection-rules/attachment_eml_file_with_ipfs_links.yml +++ b/detection-rules/attachment_eml_file_with_ipfs_links.yml @@ -8,12 +8,12 @@ type: "rule" severity: "medium" source: | type.inbound - + and any(attachments, .content_type == "message/rfc822" and any(file.explode(.), any(.scan.url.urls, strings.icontains(beta.linkanalysis(.).effective_url.url, 'ipfs') - + or ( regex.icontains(beta.linkanalysis(.).effective_url.path, '[\.-/]ipfs|ipfs[\.-/]') and beta.linkanalysis(.).effective_url.domain.domain not in $org_domains @@ -31,8 +31,14 @@ source: | ) ) ) - -tags: - - "Suspicious attachment" - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Free file host" + - "Free subdomain host" + - "IPFS" +detection_methods: + - "File analysis" + - "URL analysis" id: "1fe9d7e7-892b-5b7f-a334-53b3fbddb9fe" diff --git a/detection-rules/attachment_eml_html_attachment_portal.yml b/detection-rules/attachment_eml_html_attachment_portal.yml index 5a752414260..98d3889b126 100644 --- a/detection-rules/attachment_eml_html_attachment_portal.yml +++ b/detection-rules/attachment_eml_html_attachment_portal.yml @@ -45,8 +45,19 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Free file host" + - "Free subdomain host" - "HTML smuggling" - - "Credential phishing" + - "IPFS" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "HTML analysis" + - "Javascript analysis" + - "URL analysis" id: "6e4df158-6498-572b-9448-a343c531e5f9" diff --git a/detection-rules/attachment_eml_suspicious_link_language.yml b/detection-rules/attachment_eml_suspicious_link_language.yml index 11707ce6bfb..6e56eff21fa 100644 --- a/detection-rules/attachment_eml_suspicious_link_language.yml +++ b/detection-rules/attachment_eml_suspicious_link_language.yml @@ -49,8 +49,18 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Free file host" + - "Free subdomain host" + - "Social engineering" +detection_methods: + - "File analysis" + - "Header analysis" + - "HTML analysis" - "Natural Language Understanding" + - "Sender analysis" + - "URL analysis" id: "2038ffcc-c38e-5cb3-8594-7f40c112d08c" diff --git a/detection-rules/attachment_eml_with_html_attachment.yml b/detection-rules/attachment_eml_with_html_attachment.yml index e9daeb73e9c..68cc2a3bb4b 100644 --- a/detection-rules/attachment_eml_with_html_attachment.yml +++ b/detection-rules/attachment_eml_with_html_attachment.yml @@ -54,7 +54,16 @@ source: | ) ) tags: - - "Suspicious attachment" - - "HTML smuggling" - "Attack surface reduction" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "HTML smuggling" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "HTML analysis" + - "Sender analysis" id: "c24fd191-1685-5cb8-83ef-618225401332" diff --git a/detection-rules/attachment_emotet_heavily_padded_doc_in_zip.yml b/detection-rules/attachment_emotet_heavily_padded_doc_in_zip.yml index 97c7061d169..dd39e0e495a 100644 --- a/detection-rules/attachment_emotet_heavily_padded_doc_in_zip.yml +++ b/detection-rules/attachment_emotet_heavily_padded_doc_in_zip.yml @@ -28,6 +28,15 @@ source: | ) ) tags: - - "Suspicious attachment" - - "Emotet" + - "Malfam: Emotet" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "Exif analysis" + - "File analysis" + - "Sender analysis" id: "9a5332ed-0023-5d6e-89d3-bd789c3bde6f" diff --git a/detection-rules/attachment_encrypted_ole_unsolicited.yml b/detection-rules/attachment_encrypted_ole_unsolicited.yml index f1ba0ee9404..db7335545c1 100644 --- a/detection-rules/attachment_encrypted_ole_unsolicited.yml +++ b/detection-rules/attachment_encrypted_ole_unsolicited.yml @@ -22,7 +22,15 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" - - "Encrypted attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Encryption" + - "Macros" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "OLE analysis" + - "Sender analysis" id: "1e47e953-576c-5ba9-b84e-b72a1a89de87" diff --git a/detection-rules/attachment_excel_web_query_file_iqy.yml b/detection-rules/attachment_excel_web_query_file_iqy.yml index 9c31f4499f4..5c9666f5fa5 100644 --- a/detection-rules/attachment_excel_web_query_file_iqy.yml +++ b/detection-rules/attachment_excel_web_query_file_iqy.yml @@ -20,6 +20,12 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Archive analysis" + - "File analysis" id: "510412b5-1926-538f-a510-d796ecd2dc2d" diff --git a/detection-rules/attachment_filename_with_unicode_rtlo.yml b/detection-rules/attachment_filename_with_unicode_rtlo.yml index ae4ee1e7888..4bc236eae92 100644 --- a/detection-rules/attachment_filename_with_unicode_rtlo.yml +++ b/detection-rules/attachment_filename_with_unicode_rtlo.yml @@ -18,6 +18,11 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Archive analysis" + - "File analysis" id: "357c57a1-dd29-5ad8-ae2f-c4f4c6489575" diff --git a/detection-rules/attachment_free_subdomain_suspicious_link_language.yml b/detection-rules/attachment_free_subdomain_suspicious_link_language.yml index fbef8fd5214..3dad2cd4cab 100644 --- a/detection-rules/attachment_free_subdomain_suspicious_link_language.yml +++ b/detection-rules/attachment_free_subdomain_suspicious_link_language.yml @@ -16,7 +16,7 @@ source: | ) and length(recipients.cc) == 0 and length(recipients.bcc) == 0 - + and any(body.links, any(file.explode(beta.linkanalysis(.).screenshot), any(ml.nlu_classifier(.scan.ocr.raw).intents, @@ -24,7 +24,15 @@ source: | ) ) ) -tags: +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free subdomain host" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" - - "Suspicious link" + - "Optical Character Recognition" + - "URL analysis" + - "URL screenshot" id: "9187479c-8941-5f28-88fe-0735fd2a86bc" diff --git a/detection-rules/attachment_html_attachment_login_page.yml b/detection-rules/attachment_html_attachment_login_page.yml index f6c2fc066fb..1838f3cdc13 100644 --- a/detection-rules/attachment_html_attachment_login_page.yml +++ b/detection-rules/attachment_html_attachment_login_page.yml @@ -11,7 +11,7 @@ authors: - twitter: "ajpc500" source: | type.inbound - + and any(attachments, ( .file_extension in~ ("html", "htm", "shtml", "dhtml") or @@ -60,7 +60,15 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" + - "Sender analysis" id: "3aabf4a7-fefa-5266-83fe-012002c9db4a" diff --git a/detection-rules/attachment_html_excessive_padding.yml b/detection-rules/attachment_html_excessive_padding.yml index 84fc944fe9e..b1578f1631f 100644 --- a/detection-rules/attachment_html_excessive_padding.yml +++ b/detection-rules/attachment_html_excessive_padding.yml @@ -15,7 +15,13 @@ source: | any(.scan.yara.matches, .name == "HTML_EXCESSIVE_PADDING") ) ) -tags: +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" - - "Suspicious attachment" +detection_methods: + - "File analysis" + - "HTML analysis" + - "YARA" id: "0a6aee1e-df58-5f1e-8f49-477ed61babe5" diff --git a/detection-rules/attachment_html_recipients_suspicious_js.yml b/detection-rules/attachment_html_recipients_suspicious_js.yml index 79f87f251af..1b16511c01d 100644 --- a/detection-rules/attachment_html_recipients_suspicious_js.yml +++ b/detection-rules/attachment_html_recipients_suspicious_js.yml @@ -29,9 +29,15 @@ source: | ) ) ) -tags: +attack_types: + - "Credential Phishing" +tactics_and_techniques: - "HTML smuggling" - - "Suspicious attachments" - - "Credential phishing" - + - "Scripting" +detection_methods: + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" + - "YARA" id: "5333493d-48a8-532d-a621-d278a59bbf9b" diff --git a/detection-rules/attachment_html_smuggling_atob.yml b/detection-rules/attachment_html_smuggling_atob.yml index f996d0dfaae..f8d82676247 100644 --- a/detection-rules/attachment_html_smuggling_atob.yml +++ b/detection-rules/attachment_html_smuggling_atob.yml @@ -31,7 +31,17 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" + - "Sender analysis" + - "URL analysis" id: "03fcac11-ffc9-5a9c-9e1e-c866e683b48e" diff --git a/detection-rules/attachment_html_smuggling_auto_file_download.yml b/detection-rules/attachment_html_smuggling_auto_file_download.yml index 3060a4f4f3b..cc4a3be885d 100644 --- a/detection-rules/attachment_html_smuggling_auto_file_download.yml +++ b/detection-rules/attachment_html_smuggling_auto_file_download.yml @@ -32,7 +32,17 @@ source: | ) ) ) -tags: +attack_types: + - "Credential Phishing" +tactics_and_techniques: - "HTML smuggling" - - "Suspicious attachment" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" + - "Sender analysis" + - "URL analysis" id: "abf724f5-d59e-546c-aec2-3f1bc0e2f14b" diff --git a/detection-rules/attachment_html_smuggling_concatenation_obfuscation.yml b/detection-rules/attachment_html_smuggling_concatenation_obfuscation.yml index 25679d0929f..22e072d099b 100644 --- a/detection-rules/attachment_html_smuggling_concatenation_obfuscation.yml +++ b/detection-rules/attachment_html_smuggling_concatenation_obfuscation.yml @@ -20,7 +20,15 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" id: "108ab346-bc11-5f96-916c-678891332ae8" diff --git a/detection-rules/attachment_html_smuggling_double_encoded_zip.yml b/detection-rules/attachment_html_smuggling_double_encoded_zip.yml index 57496000133..a931b1c87cb 100644 --- a/detection-rules/attachment_html_smuggling_double_encoded_zip.yml +++ b/detection-rules/attachment_html_smuggling_double_encoded_zip.yml @@ -1,45 +1,55 @@ -name: "Attachment: Double Base64-encoded Zip File in HTML Smuggling Attachment" -description: | - Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content. -references: - - "https://twitter.com/pr0xylife/status/1593325734004768770" - - "https://github.com/Neo23x0/signature-base/blob/master/yara/mal_qbot_payloads.yar" - - "https://delivr.to/payloads?id=0e04949a-24f3-4acd-b77c-bbffc4cb3cb9" - - "https://delivr.to/payloads?id=ef39f124-6766-491c-a46c-00f2b60aa7a7" -type: "rule" -severity: "high" -authors: - - twitter: "ajpc500" -source: | - type.inbound - and ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $sender_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $sender_domains - ) - ) - and any(attachments, - .file_extension in ("html", "htm") and - any(file.explode(.), - any(.scan.strings.strings, strings.ilike(., - // Double Base64 encoded zips - "*VUVzREJCUUFBUUFJQ*", - "*VFc0RCQlFBQVFBSU*", - "*VRXNEQkJRQUFRQUlB*", - // Reversed base64 strings double encoded zips - "*QJFUUBFUUCJERzVUV*", - "*USBFVQBFlQCR0cFV*", - "*BlUQRFUQRJkQENXRV*" - ) - )) - ) -tags: - - "Suspicious attachment" - - "HTML smuggling" - - "QakBot" - - "Malware" -id: "61ebb07b-264e-59fb-a82c-d91957991081" +name: "Attachment: Double Base64-encoded Zip File in HTML Smuggling Attachment" +description: | + Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content. +references: + - "https://twitter.com/pr0xylife/status/1593325734004768770" + - "https://github.com/Neo23x0/signature-base/blob/master/yara/mal_qbot_payloads.yar" + - "https://delivr.to/payloads?id=0e04949a-24f3-4acd-b77c-bbffc4cb3cb9" + - "https://delivr.to/payloads?id=ef39f124-6766-491c-a46c-00f2b60aa7a7" +type: "rule" +severity: "high" +authors: + - twitter: "ajpc500" +source: | + type.inbound + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) + ) + and any(attachments, + .file_extension in ("html", "htm") and + any(file.explode(.), + any(.scan.strings.strings, strings.ilike(., + // Double Base64 encoded zips + "*VUVzREJCUUFBUUFJQ*", + "*VFc0RCQlFBQVFBSU*", + "*VRXNEQkJRQUFRQUlB*", + // Reversed base64 strings double encoded zips + "*QJFUUBFUUCJERzVUV*", + "*USBFVQBFlQCR0cFV*", + "*BlUQRFUQRJkQENXRV*" + ) + )) + ) +tags: + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Sender analysis" +id: "61ebb07b-264e-59fb-a82c-d91957991081" diff --git a/detection-rules/attachment_html_smuggling_embedded_b64_iso.yml b/detection-rules/attachment_html_smuggling_embedded_b64_iso.yml index 649536690c9..1bb259c77ca 100644 --- a/detection-rules/attachment_html_smuggling_embedded_b64_iso.yml +++ b/detection-rules/attachment_html_smuggling_embedded_b64_iso.yml @@ -2,8 +2,8 @@ name: "Attachment: HTML smuggling with embedded base64-encoded ISO" description: | HTML attachment contains a base-64 encoded ISO. This is a known TTP for multiple threat actors. references: - - "https://delivr.to/payloads?id=cf6c9867-4358-4b3b-b7eb-3432ac39e71d" - - "https://playground.sublimesecurity.com?id=78587abf-1027-4c6c-9edf-c1bd928de97a" + - "https://delivr.to/payloads?id=cf6c9867-4358-4b3b-b7eb-3432ac39e71d" + - "https://playground.sublimesecurity.com?id=78587abf-1027-4c6c-9edf-c1bd928de97a" type: "rule" severity: "high" source: | @@ -25,7 +25,17 @@ source: | ) )) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" + - "ISO" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Sender analysis" id: "294ecd2d-bc98-5a67-850a-60a1a29aea76" diff --git a/detection-rules/attachment_html_smuggling_embedded_b64_pe.yml b/detection-rules/attachment_html_smuggling_embedded_b64_pe.yml index 60a3cb7968c..496c97e06f6 100644 --- a/detection-rules/attachment_html_smuggling_embedded_b64_pe.yml +++ b/detection-rules/attachment_html_smuggling_embedded_b64_pe.yml @@ -2,9 +2,9 @@ name: "Attachment: HTML smuggling with embedded base64-encoded executable" description: | HTML attachmemt contains a base-64 encoded executable. references: - - "https://delivr.to/payloads?id=739e977c-8e8f-4ba8-940a-c53ba77cecca" - - "https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium" - - "https://sandbox.sublimesecurity.com?id=28fe5e67-2dec-4072-a263-24ee53cc54c3" + - "https://delivr.to/payloads?id=739e977c-8e8f-4ba8-940a-c53ba77cecca" + - "https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium" + - "https://sandbox.sublimesecurity.com?id=28fe5e67-2dec-4072-a263-24ee53cc54c3" type: "rule" severity: "high" source: | @@ -18,7 +18,14 @@ source: | and any(file.explode(.), any(.flavors.yara, . == 'base64_pe')) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" +detection_methods: + - "Archive analysis" + - "File analysis" + - "HTML analysis" + - "YARA" id: "b00c4527-957c-53ba-9eee-c5ef555b24e3" diff --git a/detection-rules/attachment_html_smuggling_embedded_base64_file_download.yml b/detection-rules/attachment_html_smuggling_embedded_base64_file_download.yml index 4e4501ac177..bc152efce18 100644 --- a/detection-rules/attachment_html_smuggling_embedded_base64_file_download.yml +++ b/detection-rules/attachment_html_smuggling_embedded_base64_file_download.yml @@ -19,7 +19,16 @@ source: | ) ) tags: + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: - "HTML smuggling" - - "Suspicious link" - - "QakBot" + - "Scripting" + - "Social engineering" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" id: "e04de4e2-154f-5cf9-b108-dbf753ece511" diff --git a/detection-rules/attachment_html_smuggling_entropy.yml b/detection-rules/attachment_html_smuggling_entropy.yml index f66ded602f9..69d3ee01881 100644 --- a/detection-rules/attachment_html_smuggling_entropy.yml +++ b/detection-rules/attachment_html_smuggling_entropy.yml @@ -23,7 +23,15 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" id: "be157288-1955-5ad1-bd6e-4e862248274b" diff --git a/detection-rules/attachment_html_smuggling_eval_atob.yml b/detection-rules/attachment_html_smuggling_eval_atob.yml index 440c5840c3d..99e9f955e75 100644 --- a/detection-rules/attachment_html_smuggling_eval_atob.yml +++ b/detection-rules/attachment_html_smuggling_eval_atob.yml @@ -16,7 +16,17 @@ source: | any(.scan.strings.strings, regex.imatch(., ".*eval.{1,4}atob.*")) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" id: "9f521ca2-2141-5373-86b1-e3cf8ed8d633" diff --git a/detection-rules/attachment_html_smuggling_fromcharcode_and_others.yml b/detection-rules/attachment_html_smuggling_fromcharcode_and_others.yml index 9bb94fd1986..94d1114a0a5 100644 --- a/detection-rules/attachment_html_smuggling_fromcharcode_and_others.yml +++ b/detection-rules/attachment_html_smuggling_fromcharcode_and_others.yml @@ -23,7 +23,17 @@ source: | "catch" in .scan.javascript.keywords ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "Javascript analysis" + - "HTML analysis" id: "a68ce0ef-dc81-5889-8d0d-735e3521d735" diff --git a/detection-rules/attachment_html_smuggling_hex_strings.yml b/detection-rules/attachment_html_smuggling_hex_strings.yml index 35a4ca210ca..32ec45b662f 100644 --- a/detection-rules/attachment_html_smuggling_hex_strings.yml +++ b/detection-rules/attachment_html_smuggling_hex_strings.yml @@ -23,7 +23,15 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" id: "b4208ed6-fdde-5165-a5ca-1fe469c64046" diff --git a/detection-rules/attachment_html_smuggling_location.yml b/detection-rules/attachment_html_smuggling_location.yml index eddf7350bd1..a12cc6adccb 100644 --- a/detection-rules/attachment_html_smuggling_location.yml +++ b/detection-rules/attachment_html_smuggling_location.yml @@ -19,7 +19,17 @@ source: | and length(.scan.javascript.identifiers) < 100 ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "Javascript analysis" + - "HTML analysis" id: "e0611295-afb2-5766-ac37-00fe81253487" diff --git a/detection-rules/attachment_html_smuggling_microsoft_signin.yml b/detection-rules/attachment_html_smuggling_microsoft_signin.yml index e5a94a3e37e..8c7359a0542 100644 --- a/detection-rules/attachment_html_smuggling_microsoft_signin.yml +++ b/detection-rules/attachment_html_smuggling_microsoft_signin.yml @@ -36,7 +36,19 @@ source: | ) // allow Microsoft domains just to be safe and sender.email.domain.root_domain not in~ ('microsoft.com', 'microsoftsupport.com', 'office.com') -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free subdomain host" - "HTML smuggling" + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Javascript analysis" + - "Sender analysis" + - "URL analysis" id: "878d6385-95c2-5540-a887-a6fa9456409c" diff --git a/detection-rules/attachment_html_smuggling_raw_buffer.yml b/detection-rules/attachment_html_smuggling_raw_buffer.yml index eb554c8733e..8f7c837bfdf 100644 --- a/detection-rules/attachment_html_smuggling_raw_buffer.yml +++ b/detection-rules/attachment_html_smuggling_raw_buffer.yml @@ -24,7 +24,15 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Free subdomain host" - "HTML smuggling" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "Javascript analysis" id: "a0d5c3dc-0763-5579-919e-456e5a37bd6f" diff --git a/detection-rules/attachment_html_smuggling_rc4.yml b/detection-rules/attachment_html_smuggling_rc4.yml index 84583c1ddb4..6a14559da2a 100644 --- a/detection-rules/attachment_html_smuggling_rc4.yml +++ b/detection-rules/attachment_html_smuggling_rc4.yml @@ -18,7 +18,17 @@ source: | and any(file.explode(.), any(.scan.strings.strings, strings.ilike(., "*?[(?[?]+?[?])%256]*"))) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Encryption" + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" id: "3a46d765-4b27-5026-9b8e-043e3817854b" diff --git a/detection-rules/attachment_html_smuggling_rot13.yml b/detection-rules/attachment_html_smuggling_rot13.yml index 77d9cceb8ed..6f129e3d32f 100644 --- a/detection-rules/attachment_html_smuggling_rot13.yml +++ b/detection-rules/attachment_html_smuggling_rot13.yml @@ -21,7 +21,18 @@ source: | and length(.scan.javascript.identifiers) < 100 ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Encryption" + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "Javascript analysis" + - "HTML analysis" id: "6eacc4cf-9357-5441-9380-b561fa630d65" diff --git a/detection-rules/attachment_html_smuggling_settimeout.yml b/detection-rules/attachment_html_smuggling_settimeout.yml index c43e57d571d..75ffc820492 100644 --- a/detection-rules/attachment_html_smuggling_settimeout.yml +++ b/detection-rules/attachment_html_smuggling_settimeout.yml @@ -16,7 +16,17 @@ source: | and any(.scan.strings.strings, strings.ilike(., "*location.href*")) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" id: "4e0b2c32-d176-5351-9b74-1636179a8cda" diff --git a/detection-rules/attachment_html_smuggling_unescape.yml b/detection-rules/attachment_html_smuggling_unescape.yml index 422df259f4d..de8e19bdfc4 100644 --- a/detection-rules/attachment_html_smuggling_unescape.yml +++ b/detection-rules/attachment_html_smuggling_unescape.yml @@ -16,7 +16,16 @@ source: | and any(file.explode(.), any(.scan.javascript.identifiers, . == "unescape")) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" id: "0b0fed36-735a-50f1-bf10-6673237a4623" diff --git a/detection-rules/attachment_ics_embedded_document.yml b/detection-rules/attachment_ics_embedded_document.yml index f9271b300b7..11e2ef560b7 100644 --- a/detection-rules/attachment_ics_embedded_document.yml +++ b/detection-rules/attachment_ics_embedded_document.yml @@ -19,6 +19,10 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "File analysis" id: "8f9957d9-a06a-5c5a-83af-2dc5c25bed86" diff --git a/detection-rules/attachment_ics_link_to_executable_suspicious_language.yml b/detection-rules/attachment_ics_link_to_executable_suspicious_language.yml index a680c9aafd0..119efb8056d 100644 --- a/detection-rules/attachment_ics_link_to_executable_suspicious_language.yml +++ b/detection-rules/attachment_ics_link_to_executable_suspicious_language.yml @@ -19,7 +19,12 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Social engineering" +detection_methods: + - "File analysis" - "Natural Language Understanding" id: "7dd310ca-8939-52f3-b840-16ee5679d837" diff --git a/detection-rules/attachment_js_file_execution.yml b/detection-rules/attachment_js_file_execution.yml index 85da6e34d0a..fc73efcddaa 100644 --- a/detection-rules/attachment_js_file_execution.yml +++ b/detection-rules/attachment_js_file_execution.yml @@ -24,6 +24,15 @@ source: | ) ) tags: - - "Suspicious attachment" - "Attack surface reduction" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Javascript analysis" + - "Sender analysis" id: "627ae0b1-fbe7-58cf-ba7d-0cf51b806c8a" diff --git a/detection-rules/attachment_lnk_file.yml b/detection-rules/attachment_lnk_file.yml index 533d85051fb..08febe29f57 100644 --- a/detection-rules/attachment_lnk_file.yml +++ b/detection-rules/attachment_lnk_file.yml @@ -18,6 +18,11 @@ source: | and any(file.explode(.), .file_extension =~ "lnk") ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "LNK" +detection_methods: + - "Archive analysis" + - "File analysis" id: "44532abe-f65f-54e6-afe2-d4589e4253ae" diff --git a/detection-rules/attachment_lnk_file_with_embedded_content.yml b/detection-rules/attachment_lnk_file_with_embedded_content.yml index f9c9b36b71e..24e9fce3974 100644 --- a/detection-rules/attachment_lnk_file_with_embedded_content.yml +++ b/detection-rules/attachment_lnk_file_with_embedded_content.yml @@ -23,7 +23,16 @@ source: | ) ) ) - tags: - - "Suspicious attachment" + - "Malfam: Emotet" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Exploit" + - "LNK" + - "Scripting" +detection_methods: + - "Content analysis" + - "Exif analysis" + - "File analysis" id: "41452f7a-c77d-5259-a5fb-91b1b4419364" diff --git a/detection-rules/attachment_macro_dll_loader.yml b/detection-rules/attachment_macro_dll_loader.yml index 26e5c2d83be..110c4bcb136 100644 --- a/detection-rules/attachment_macro_dll_loader.yml +++ b/detection-rules/attachment_macro_dll_loader.yml @@ -34,8 +34,16 @@ source: | ) ) ) -tags: - - "Suspicious attachment" - - "Office exploit" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Exploit" + - "LNK" - "Macros" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Macro analysis" + - "YARA" id: "3a193f5f-1596-54d8-8fd7-1e09e63e6ea4" diff --git a/detection-rules/attachment_malicious_onenote_commands.yml b/detection-rules/attachment_malicious_onenote_commands.yml index 2a68dd2ce80..5e9422f5c44 100644 --- a/detection-rules/attachment_malicious_onenote_commands.yml +++ b/detection-rules/attachment_malicious_onenote_commands.yml @@ -36,7 +36,14 @@ source: | ) ) ) -tags: - - "Suspicious attachment" - - "Malware" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "OneNote" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "YARA" id: "7319f0eb-a3c7-5320-a4ae-6fbf7952369e" diff --git a/detection-rules/attachment_malwarebazaar.yml b/detection-rules/attachment_malwarebazaar.yml index 9bc890f99c7..96091611291 100644 --- a/detection-rules/attachment_malwarebazaar.yml +++ b/detection-rules/attachment_malwarebazaar.yml @@ -1,6 +1,5 @@ name: "MalwareBazaar: Malicious attachment hash (trusted reporters)" -description: "Detects if an attachment's SHA256 hash matches a SHA256 hash reported as malware - on MalwareBazaar by trusted reporters from first-time senders." +description: "Detects if an attachment's SHA256 hash matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters from first-time senders." type: "rule" severity: "medium" source: | @@ -17,8 +16,11 @@ source: | ) ) tags: - - "MalwareBazaar" - - "Abusech" - - "Suspicious attachment" - - "Malware" + - "Abusech: MalwareBazaar" +attack_types: + - "Malware/Ransomware" +detection_methods: + - "File analysis" + - "Sender analysis" + - "Threat intelligence" id: "5b5c9c3e-92c2-56cd-ad0d-1a2e195fa2b4" diff --git a/detection-rules/attachment_mht_embedded_vbscript.yml b/detection-rules/attachment_mht_embedded_vbscript.yml index eb446f00df6..eb726a3b679 100644 --- a/detection-rules/attachment_mht_embedded_vbscript.yml +++ b/detection-rules/attachment_mht_embedded_vbscript.yml @@ -33,7 +33,14 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" - - "Malware" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "HTML analysis" + - "Sender analysis" id: "b30353a6-773e-5b6d-9252-751b5bc95799" diff --git a/detection-rules/attachment_microsoft_image_lure_qr_code.yml b/detection-rules/attachment_microsoft_image_lure_qr_code.yml index 4fda032ffce..63e026b0764 100644 --- a/detection-rules/attachment_microsoft_image_lure_qr_code.yml +++ b/detection-rules/attachment_microsoft_image_lure_qr_code.yml @@ -45,8 +45,15 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" - - "Brand impersonation" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" - "QR code" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Header analysis" + - "QR code analysis" + - "Sender analysis" id: "ed0f772a-6543-5947-80d1-55a11ea63074" diff --git a/detection-rules/attachment_msi_installer.yml b/detection-rules/attachment_msi_installer.yml index 27ffb0b5538..3f2809e0f14 100644 --- a/detection-rules/attachment_msi_installer.yml +++ b/detection-rules/attachment_msi_installer.yml @@ -3,7 +3,7 @@ description: | Recursively scans files and archives to detect MSI installer files. Coercing a target user to run an MSI can be used as part of an 'IT Support' or 'software update' social engineering attack. - + Execution of the delivered MSI could enable the attacker to execute malicious code on the target user's host. references: - "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md" @@ -24,6 +24,11 @@ source: | ) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Archive analysis" + - "File analysis" id: "ae17b1a9-41e3-513c-9762-0c3fd30b9818" diff --git a/detection-rules/attachment_office365_image.yml b/detection-rules/attachment_office365_image.yml index 2dcbccdff5a..c5b859c224b 100644 --- a/detection-rules/attachment_office365_image.yml +++ b/detection-rules/attachment_office365_image.yml @@ -84,6 +84,15 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Optical Character Recognition" + - "Sender analysis" id: "edce0229-5e8f-5359-a5c8-36570840049f" diff --git a/detection-rules/attachment_office_file_with_vsto.yml b/detection-rules/attachment_office_file_with_vsto.yml index 7372ad8f65f..e002db57b4c 100644 --- a/detection-rules/attachment_office_file_with_vsto.yml +++ b/detection-rules/attachment_office_file_with_vsto.yml @@ -16,6 +16,15 @@ source: | and strings.ilike(.value, "*.vsto*")) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "Exif analysis" + - "File analysis" + - "Sender analysis" + - "URL analysis" id: "27afa730-6dd5-58ec-9deb-ed5170de210d" diff --git a/detection-rules/attachment_office_remote_doc_template.yml b/detection-rules/attachment_office_remote_doc_template.yml index 4a7803a156c..4d5a98f36d5 100644 --- a/detection-rules/attachment_office_remote_doc_template.yml +++ b/detection-rules/attachment_office_remote_doc_template.yml @@ -20,7 +20,10 @@ source: | ) ) ) -tags: - - "Suspicious attachment" - - "Office exploit" +attack_types: + - "Malware/Ransomware" +detection_methods: + - "Archive analysis" + - "File analysis" + - "URL analysis" id: "d9601104-c330-5995-9fae-4d30b969c081" diff --git a/detection-rules/attachment_pdf_credtheft_link_suspicious_file.yml b/detection-rules/attachment_pdf_credtheft_link_suspicious_file.yml index ecddad76814..2eba94214f6 100644 --- a/detection-rules/attachment_pdf_credtheft_link_suspicious_file.yml +++ b/detection-rules/attachment_pdf_credtheft_link_suspicious_file.yml @@ -21,9 +21,17 @@ source: | ) ) ) -tags: +tags: + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "PDF" +detection_methods: + - "File analysis" - "Natural Language Understanding" - - "Suspicious attachment" - - "Suspicious link" - - "QakBot" + - "Optical Character Recognition" + - "URL analysis" id: "adda3c3f-8966-5f46-9924-234bbaee0a2c" diff --git a/detection-rules/attachment_pdf_file_fraudulent_cryptocurrency_exchange.yml b/detection-rules/attachment_pdf_file_fraudulent_cryptocurrency_exchange.yml index 97c4fd3560d..f774f6cec4b 100644 --- a/detection-rules/attachment_pdf_file_fraudulent_cryptocurrency_exchange.yml +++ b/detection-rules/attachment_pdf_file_fraudulent_cryptocurrency_exchange.yml @@ -8,17 +8,28 @@ references: type: "rule" severity: "low" source: | - type.inbound - and sender.email.domain.root_domain in $free_email_providers - and length(attachments) == 1 - and all(attachments, .file_extension == "pdf" - and regex.icontains(.file_name, '(\d\.\d{3,4}.{0,12}BTC|bitcoin)') - and any(file.explode(.), - .scan.exiftool.page_count >=5 - and .depth == 0 - and length(filter(.scan.strings.strings, regex.match(.,'^\/URI \(http.*'))) == 1) - ) + type.inbound + and sender.email.domain.root_domain in $free_email_providers + and length(attachments) == 1 + and all(attachments, .file_extension == "pdf" + and regex.icontains(.file_name, '(\d\.\d{3,4}.{0,12}BTC|bitcoin)') + and any(file.explode(.), + .scan.exiftool.page_count >=5 + and .depth == 0 + and length(filter(.scan.strings.strings, regex.match(.,'^\/URI \(http.*'))) == 1) + ) tags: - "Cryptocurrency" - - "Fraud" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Free email provider" + - "Impersonation: Brand" + - "PDF" + - "Social engineering" +detection_methods: + - "Exif analysis" + - "File analysis" + - "Sender analysis" + - "URL analysis" id: "47601cb7-5278-58b1-b503-0456c235a18d" diff --git a/detection-rules/attachment_pdf_file_with_embedded_content.yml b/detection-rules/attachment_pdf_file_with_embedded_content.yml index 26e2f7f7afb..65cdf617f72 100644 --- a/detection-rules/attachment_pdf_file_with_embedded_content.yml +++ b/detection-rules/attachment_pdf_file_with_embedded_content.yml @@ -47,6 +47,12 @@ source: | "hta_file")) ) )) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "PDF" +detection_methods: + - "File analysis" + - "Sender analysis" + - "YARA" id: "c2e04516-2e6c-5079-8b67-327578e98315" diff --git a/detection-rules/attachment_pdf_linking_to_password_protected_file.yml b/detection-rules/attachment_pdf_linking_to_password_protected_file.yml index 468ae2680c6..1c06ab53db8 100644 --- a/detection-rules/attachment_pdf_linking_to_password_protected_file.yml +++ b/detection-rules/attachment_pdf_linking_to_password_protected_file.yml @@ -1,38 +1,47 @@ name: "Attachment: Adobe branded PDF file linking to a password-protected file from first-time sender" description: | - Detects pdf files with links to a remotely hosted password-protected file. This is a common technique - abused by Phishing actors as well as Malware actors (IcedID, Remcos, Async Rat) + Detects pdf files with links to a remotely hosted password-protected file. This is a common technique + abused by Phishing actors as well as Malware actors (IcedID, Remcos, Async Rat) type: "rule" severity: "high" source: | - type.inbound + type.inbound - and any(attachments, .file_extension == "pdf" - and any(file.explode(.), - any(ml.nlu_classifier(.scan.ocr.raw).intents, - .name == "cred_theft" and .confidence == "high" - ) - - and strings.icontains(.scan.ocr.raw, "password-protected") - - and any(ml.nlu_classifier(.scan.ocr.raw).entities, - .name == "org" and .text == "Adobe" - ) - ) - ) + and any(attachments, .file_extension == "pdf" + and any(file.explode(.), + any(ml.nlu_classifier(.scan.ocr.raw).intents, + .name == "cred_theft" and .confidence == "high" + ) + + and strings.icontains(.scan.ocr.raw, "password-protected") + + and any(ml.nlu_classifier(.scan.ocr.raw).entities, + .name == "org" and .text == "Adobe" + ) + ) + ) - and ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $sender_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $sender_domains - ) - ) -tags: - - "Machine Learning" - - "Suspicious attachment" + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) + ) +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Encryption" + - "Evasion" + - "Impersonation: Brand" + - "PDF" +detection_methods: + - "Archive analysis" + - "File analysis" - "Natural Language Understanding" + - "Optical Character Recognition" + - "Sender analysis" id: "5ea75469-58e8-561e-9a19-24da14a946b7" diff --git a/detection-rules/attachment_pdf_with_google_ae_redirect.yml b/detection-rules/attachment_pdf_with_google_ae_redirect.yml index 430f1ac7e54..b9e675bd503 100644 --- a/detection-rules/attachment_pdf_with_google_ae_redirect.yml +++ b/detection-rules/attachment_pdf_with_google_ae_redirect.yml @@ -2,7 +2,7 @@ name: "PDF attachment with Google (AE) redirecting to a php file" description: "Detects a PDF attachment with a link that contains a Google.ae redirect URL" references: - "https://twitter.com/Cryptolaemus1/status/1649200761610571776?s=20" - - "https://analyzer.sublime.security?id=142822c9-8195-47bd-96e3-b8a26267c03c" + - "https://analyzer.sublime.security?id=142822c9-8195-47bd-96e3-b8a26267c03c" type: "rule" severity: "high" source: | @@ -20,7 +20,14 @@ source: | ) ) tags: - - "Suspicious attachment" + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" - - "QakBot" + - "PDF" +detection_methods: + - "Content analysis" + - "File analysis" + - "URL analysis" id: "57ae513f-54b6-5ddd-9527-449a6d2a23c3" diff --git a/detection-rules/attachment_pdf_with_link_to_zip_containing_wsf.yml b/detection-rules/attachment_pdf_with_link_to_zip_containing_wsf.yml index 013537e5211..6cab6954a6b 100644 --- a/detection-rules/attachment_pdf_with_link_to_zip_containing_wsf.yml +++ b/detection-rules/attachment_pdf_with_link_to_zip_containing_wsf.yml @@ -1,6 +1,6 @@ name: "Attachment: PDF with link to zip containing a wsf file" description: "Detects a PDF attachment with a link to a ZIP file that contains a WSF file" -references: +references: - "https://analyzer.sublime.security/?id=596edcf4-507e-4714-8b2d-b1f51c258c70" - "https://twitter.com/Cryptolaemus1/status/1649091718552379392" - "https://twitter.com/Cryptolaemus1/status/1650826597333696515" @@ -26,6 +26,15 @@ source: | ) ) tags: - - "Suspicious attachment" - - "QakBot" + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "PDF" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "URL analysis" id: "93bc7db4-248f-502a-bc9a-919915cbc0fb" diff --git a/detection-rules/attachment_pdf_with_low_reputation_link_to_suspicious_files.yml b/detection-rules/attachment_pdf_with_low_reputation_link_to_suspicious_files.yml index 84d163e83e8..da90feb2835 100644 --- a/detection-rules/attachment_pdf_with_low_reputation_link_to_suspicious_files.yml +++ b/detection-rules/attachment_pdf_with_low_reputation_link_to_suspicious_files.yml @@ -28,8 +28,15 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) - tags: - - "Suspicious attachment" - - "Ave Maria" + - "Malfam: Ave Maria" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "PDF" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Sender analysis" id: "6144f880-a4f0-5776-b7cc-2f89d3bb5000" diff --git a/detection-rules/attachment_pdf_with_low_reputation_link_to_zip_file.yml b/detection-rules/attachment_pdf_with_low_reputation_link_to_zip_file.yml index dcacd0a3bcf..fa4445966f9 100644 --- a/detection-rules/attachment_pdf_with_low_reputation_link_to_zip_file.yml +++ b/detection-rules/attachment_pdf_with_low_reputation_link_to_zip_file.yml @@ -31,6 +31,16 @@ source: | ) ) tags: - - "Suspicious attachment" - - "QakBot" + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "PDF" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Natural Language Understanding" + - "Sender analysis" + - "URL analysis" id: "d1ee2859-acd1-5c12-9b74-89439ed1eaf1" diff --git a/detection-rules/attachment_potential_sandbox_evasion_in_office_file.yml b/detection-rules/attachment_potential_sandbox_evasion_in_office_file.yml index 6307626333f..5337ab10cb4 100644 --- a/detection-rules/attachment_potential_sandbox_evasion_in_office_file.yml +++ b/detection-rules/attachment_potential_sandbox_evasion_in_office_file.yml @@ -23,6 +23,12 @@ source: | ))) >= 1 ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Macros" +detection_methods: + - "File analysis" + - "Macro analysis" id: "1c591681-3f02-5d1e-be08-fc1e6793c68b" diff --git a/detection-rules/attachment_powershell_content.yml b/detection-rules/attachment_powershell_content.yml index 2cede6a35d9..dd04a89d362 100644 --- a/detection-rules/attachment_powershell_content.yml +++ b/detection-rules/attachment_powershell_content.yml @@ -25,6 +25,11 @@ source: | ("ps1", "ps1xml", "psm1", "psd1", "pssc", "psrc", "cdxml", "ps2", "ps2xml", "psc2",) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" id: "c12566db-83af-506a-b9be-adbc01755999" diff --git a/detection-rules/attachment_rdp_connection_file.yml b/detection-rules/attachment_rdp_connection_file.yml index 2be7aef45ed..fe1d1bdf823 100644 --- a/detection-rules/attachment_rdp_connection_file.yml +++ b/detection-rules/attachment_rdp_connection_file.yml @@ -21,5 +21,11 @@ source: | ) ) tags: - - "Suspicious attachment" + - "Attack surface reduction" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +detection_methods: + - "Archive analysis" + - "File analysis" id: "2409a422-4116-5a40-b929-c1b47ed5c1e5" diff --git a/detection-rules/attachment_rtf_embedded_content.yml b/detection-rules/attachment_rtf_embedded_content.yml index 20ac5f578a8..6b58cfec305 100644 --- a/detection-rules/attachment_rtf_embedded_content.yml +++ b/detection-rules/attachment_rtf_embedded_content.yml @@ -17,6 +17,11 @@ source: | or .file_extension in~ ("bat", "exe", "vbs") ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "File analysis" + - "YARA" id: "61dd2dd7-21cf-58be-bd58-87ae677a00ab" diff --git a/detection-rules/attachment_sfx_commands.yml b/detection-rules/attachment_sfx_commands.yml index 705e4539ce7..5a511230f96 100644 --- a/detection-rules/attachment_sfx_commands.yml +++ b/detection-rules/attachment_sfx_commands.yml @@ -14,6 +14,11 @@ source: | and any(.scan.strings.strings, strings.ilike(., 'Setup=*')) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Scripting" +detection_methods: + - "File analysis" id: "343e6c8c-8e46-5f3d-a5ee-c79360f73376" diff --git a/detection-rules/attachment_shellbrowserwindow_com_object_in_macro.yml b/detection-rules/attachment_shellbrowserwindow_com_object_in_macro.yml index 9c8631918d1..7860c972952 100644 --- a/detection-rules/attachment_shellbrowserwindow_com_object_in_macro.yml +++ b/detection-rules/attachment_shellbrowserwindow_com_object_in_macro.yml @@ -23,6 +23,13 @@ source: | )) ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Macros" + - "Scripting" +detection_methods: + - "Content analysis" + - "File analysis" + - "Macro analysis" id: "527fc7f0-2750-57e2-bf2f-fbfea88b1004" diff --git a/detection-rules/attachment_soliciting_enable_macros.yml b/detection-rules/attachment_soliciting_enable_macros.yml index 03ffa8d6b96..fa6dded2b49 100644 --- a/detection-rules/attachment_soliciting_enable_macros.yml +++ b/detection-rules/attachment_soliciting_enable_macros.yml @@ -28,7 +28,14 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: - "Macros" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Macro analysis" + - "Optical Character Recognition" + - "Sender analysis" id: "e9d75515-8d64-531d-8ccb-9153150d0ee3" diff --git a/detection-rules/attachment_suspicious_vba_macro_first_time_sender.yml b/detection-rules/attachment_suspicious_vba_macro_first_time_sender.yml index 3af7d5e3813..7ddfae736ab 100644 --- a/detection-rules/attachment_suspicious_vba_macro_first_time_sender.yml +++ b/detection-rules/attachment_suspicious_vba_macro_first_time_sender.yml @@ -19,8 +19,12 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: - "Macros" - - "Machine Learning" +detection_methods: + - "File analysis" + - "Macro analysis" + - "Sender analysis" id: "37cec120-2757-5e99-a489-1315780dae08" diff --git a/detection-rules/attachment_svg_embedded_js.yml b/detection-rules/attachment_svg_embedded_js.yml index 02549b90e3e..6945b1d03ce 100644 --- a/detection-rules/attachment_svg_embedded_js.yml +++ b/detection-rules/attachment_svg_embedded_js.yml @@ -39,7 +39,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" - - "Malware" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Sender analysis" + - "XML analysis" id: "f70293bc-b6da-5dbd-8756-e3ca282aba35" diff --git a/detection-rules/attachment_svg_file_execution.yml b/detection-rules/attachment_svg_file_execution.yml index 7b3472628ef..52db4e75e64 100644 --- a/detection-rules/attachment_svg_file_execution.yml +++ b/detection-rules/attachment_svg_file_execution.yml @@ -27,7 +27,12 @@ source: | and any(.scan.strings.strings, strings.like(., "*Run*", "*Execute*")) ) ) -tags: - - "Suspicious attachment" - - "Malware" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" id: "084b0cde-4352-5624-b1e8-2d9ecd1f7218" diff --git a/detection-rules/attachment_uncommon_compressed.yml b/detection-rules/attachment_uncommon_compressed.yml index cb8775fa43c..488e25a7fd9 100644 --- a/detection-rules/attachment_uncommon_compressed.yml +++ b/detection-rules/attachment_uncommon_compressed.yml @@ -9,9 +9,13 @@ type: "rule" severity: "low" source: | type.inbound - and any(attachments, .file_extension in ('tar', 'iso', 'img', 'cab', - 'gadget', 'uue')) + and any(attachments, .file_extension in ('tar', 'iso', 'img', 'cab', 'gadget', 'uue')) tags: - - "Suspicious attachment" - "Attack surface reduction" -id: "0c6fba7a-b8a9-5491-a32c-411882e10c79" +attack_types: + - "Malware/Ransomware" + - "Credential Phishing" +detection_methods: + - "Archive analysis" + - "File analysis" +id: "0c6fba7a-b8a9-5491-a32c-411882e10c79" \ No newline at end of file diff --git a/detection-rules/attachment_url_with_unc_path.yml b/detection-rules/attachment_url_with_unc_path.yml index 86eb9ee8b11..366944f0bd7 100644 --- a/detection-rules/attachment_url_with_unc_path.yml +++ b/detection-rules/attachment_url_with_unc_path.yml @@ -13,7 +13,11 @@ source: | or any(.scan.strings.strings, regex.icontains(., '%5C%5C([a-zA-Z0-9_:%.$-]+)%5C([a-zA-Z0-9_:%.$-]+)')) // percent-encoded UNC paths ) ) -tags: - - "Suspicious attachment" - - "Windows exploit" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "LNK" +detection_methods: + - "File analysis" id: "3b7ee0fb-3540-51b6-a5db-9b21fdd3c9af" diff --git a/detection-rules/attachment_vba_macro_auto_exec_unsolicited.yml b/detection-rules/attachment_vba_macro_auto_exec_unsolicited.yml index 2a0b19bab79..d4ba1a6a1c0 100644 --- a/detection-rules/attachment_vba_macro_auto_exec_unsolicited.yml +++ b/detection-rules/attachment_vba_macro_auto_exec_unsolicited.yml @@ -1,7 +1,7 @@ name: "Attachment with auto-executing macro (unsolicited)" description: | Attachment from an unsolicited sender contains a macro that will auto-execute when the file is opened. - + Macros are a common phishing technique used to deploy malware. references: - "https://www.trustedsec.com/blog/malicious-macros-for-script-kiddies/" @@ -23,13 +23,21 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) - + // negate replies and ( length(headers.references) == 0 or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To"))) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: - "Macros" +detection_methods: + - "Archive analysis" + - "Header analysis" + - "File analysis" + - "Macro analysis" + - "OLE analysis" + - "Sender analysis" id: "af6624c3-2a28-5fbb-8936-fb29e55dd29d" diff --git a/detection-rules/attachment_vba_macro_auto_open_unsolicited.yml b/detection-rules/attachment_vba_macro_auto_open_unsolicited.yml index 988f8865253..37dfcf5b083 100644 --- a/detection-rules/attachment_vba_macro_auto_open_unsolicited.yml +++ b/detection-rules/attachment_vba_macro_auto_open_unsolicited.yml @@ -26,7 +26,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: - "Macros" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Macro analysis" + - "Sender analysis" id: "d48b3e53-dee4-546b-b81a-0c781929fdfb" diff --git a/detection-rules/attachment_vba_macro_calling_executable.yml b/detection-rules/attachment_vba_macro_calling_executable.yml index ca1032e06a8..ca8f74e4bcd 100644 --- a/detection-rules/attachment_vba_macro_calling_executable.yml +++ b/detection-rules/attachment_vba_macro_calling_executable.yml @@ -13,7 +13,12 @@ source: | and any(file.explode(.), any(.scan.vba.hex, strings.ilike(., "*exe*"))) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" - "Macros" +detection_methods: + - "Archive analysis" + - "File analysis" id: "5ee6a197-eea0-505a-a4d9-24addaf23d3c" diff --git a/detection-rules/attachment_vba_macro_employee_impersonation.yml b/detection-rules/attachment_vba_macro_employee_impersonation.yml index d6826b1432d..64fa45578d8 100644 --- a/detection-rules/attachment_vba_macro_employee_impersonation.yml +++ b/detection-rules/attachment_vba_macro_employee_impersonation.yml @@ -1,7 +1,7 @@ name: "Attachment with VBA macros from employee impersonation (unsolicited)" description: | Attachment contains a VBA macro from a sender your organization has never sent an email to. - + Sender is using a display name that matches the display name of someone in your organization. @@ -27,10 +27,15 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Impersonation: Employee" - "Macros" - - "Unsolicited" - - "Suspicious sender" - - "Employee impersonation" + - "Social engineering" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Macro analysis" + - "Sender analysis" id: "9b262123-9010-5245-89a7-9ebd75333b2a" diff --git a/detection-rules/attachment_vba_macro_high_risk.yml b/detection-rules/attachment_vba_macro_high_risk.yml index c663ed6ec92..56be092673d 100644 --- a/detection-rules/attachment_vba_macro_high_risk.yml +++ b/detection-rules/attachment_vba_macro_high_risk.yml @@ -21,7 +21,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: - "Macros" +detection_methods: + - "File analysis" + - "Macro analysis" + - "OLE analysis" + - "Sender analysis" id: "a2b20e16-b363-50f1-92a5-ee6c41012118" diff --git a/detection-rules/attachment_with_encrypted_zip_unsolicited.yml b/detection-rules/attachment_with_encrypted_zip_unsolicited.yml index 9ee26a8fac6..c81f3e21e0b 100644 --- a/detection-rules/attachment_with_encrypted_zip_unsolicited.yml +++ b/detection-rules/attachment_with_encrypted_zip_unsolicited.yml @@ -20,6 +20,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Encryption" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Sender analysis" id: "697c87ae-943d-54a0-a41b-ba1667147e03" diff --git a/detection-rules/attachment_with_suspicious_author_unsolicited.yml b/detection-rules/attachment_with_suspicious_author_unsolicited.yml index 845d0bdd9e5..5a9e5decc7f 100644 --- a/detection-rules/attachment_with_suspicious_author_unsolicited.yml +++ b/detection-rules/attachment_with_suspicious_author_unsolicited.yml @@ -19,6 +19,9 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +detection_methods: + - "File analysis" + - "Sender analysis" id: "40f518b9-88a2-59c5-8f6a-54bfd0fdf209" diff --git a/detection-rules/attachment_with_unknown_encrypted_zip_unsolicited.yml b/detection-rules/attachment_with_unknown_encrypted_zip_unsolicited.yml index 5caa3cb3b18..f8204c292ae 100644 --- a/detection-rules/attachment_with_unknown_encrypted_zip_unsolicited.yml +++ b/detection-rules/attachment_with_unknown_encrypted_zip_unsolicited.yml @@ -23,6 +23,14 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Encryption" + - "Evasion" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Sender analysis" + - "YARA" id: "529d4a9a-ffa7-5a53-a065-df244ec67e7a" diff --git a/detection-rules/body_business_email_compromise_new_sender.yml b/detection-rules/body_business_email_compromise_new_sender.yml index 4019a8c128b..18e7cea6a04 100644 --- a/detection-rules/body_business_email_compromise_new_sender.yml +++ b/detection-rules/body_business_email_compromise_new_sender.yml @@ -1,6 +1,6 @@ name: "Body: Business Email Compromise (BEC) attempt from first-time sender" description: | - Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from first-time senders. + Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from first-time senders. type: "rule" severity: "medium" source: | @@ -22,9 +22,13 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Machine Learning" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" - - "Suspicious sender" - - "Business Email Compromise" + - "Sender analysis" id: "96d4c35a-ca53-559e-9db3-349dbbdffc20" diff --git a/detection-rules/body_business_email_compromise_unsolicited.yml b/detection-rules/body_business_email_compromise_unsolicited.yml index 73d3205001f..56610cc6c3a 100644 --- a/detection-rules/body_business_email_compromise_unsolicited.yml +++ b/detection-rules/body_business_email_compromise_unsolicited.yml @@ -1,6 +1,6 @@ name: "Body: Business Email Compromise (BEC) attempt from unsolicited sender" description: | - Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from unsolicited senders. + Detects potential Business Email Compromise (BEC) attacks by analyzing text within the email body from unsolicited senders. type: "rule" severity: "medium" source: | @@ -38,9 +38,14 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Machine Learning" - - "Natural Language Understanding" - - "Suspicious sender" - - "Business Email Compromise" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Social engineering" + - "Spoofing" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Sender analysis" id: "57eccc45-0408-55ee-ae33-8203e166254a" diff --git a/detection-rules/body_callback_phishing_no_attachment.yml b/detection-rules/body_callback_phishing_no_attachment.yml index 1a35d0896d7..f537ce3ce84 100644 --- a/detection-rules/body_callback_phishing_no_attachment.yml +++ b/detection-rules/body_callback_phishing_no_attachment.yml @@ -18,7 +18,7 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) - + and sender.email.domain.root_domain in $free_email_providers and strings.ilike(body.plain.raw, "*mcafee*", "*norton*", "*geek squad*", "*paypal*", "*ebay*", "*symantec*", "*best buy*", "*lifelock*") and 4 of ( @@ -35,7 +35,14 @@ source: | strings.ilike(body.plain.raw, '*refund*'), strings.ilike(body.plain.raw, '*+1*') ) -tags: +attack_types: - "Callback Phishing" - - "Customer service fraud" +tactics_and_techniques: + - "Free email provider" + - "Impersonation: Brand" + - "Out of band pivot" + - "Social engineering" +detection_methods: + - "File analysis" + - "Sender analysis" id: "10a3a446-c70f-5843-a4e4-4d815d33fcb1" diff --git a/detection-rules/body_extortion.yml b/detection-rules/body_extortion.yml index 7d08f96cfe6..62fb414bdda 100644 --- a/detection-rules/body_extortion.yml +++ b/detection-rules/body_extortion.yml @@ -1,7 +1,7 @@ name: "Extortion / sextortion (first-time sender)" description: | - Detects extortion and sextortion attempts by analyzing the email body text from a first-time sender. -references: + Detects extortion and sextortion attempts by analyzing the email body text from a first-time sender. +references: - "https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" type: "rule" severity: "low" @@ -28,10 +28,14 @@ source: | // many extortion emails spoof sender domains and fail sender authentication or any(headers.hops, .authentication_results.dmarc == "fail") ) - -tags: - - "Machine Learning" - - "Natural Language Understanding" +attack_types: - "Extortion" - - "Sextortion" +tactics_and_techniques: + - "Social engineering" + - "Spoofing" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Natural Language Understanding" + - "Sender analysis" id: "265913eb-2ccd-5f77-9a09-f6d8539fd2f6" diff --git a/detection-rules/body_html_callback_phishing_no_attachment.yml b/detection-rules/body_html_callback_phishing_no_attachment.yml index 9cb24d4f6c3..2241ffac3b7 100644 --- a/detection-rules/body_html_callback_phishing_no_attachment.yml +++ b/detection-rules/body_html_callback_phishing_no_attachment.yml @@ -6,37 +6,45 @@ description: | type: "rule" severity: "medium" source: | - type.inbound - and length(attachments) == 0 - and ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $recipient_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $recipient_domains - ) - ) - - and sender.email.domain.root_domain in $free_email_providers - and any([body.html.inner_text], strings.ilike(., "*mcafee*", "*norton*", "*geek squad*", "*paypal*", "*ebay*", "*symantec*", "*best buy*", "*lifelock*")) - and any([body.html.inner_text], strings.ilike(., "*+1*")) + type.inbound + and length(attachments) == 0 + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $recipient_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $recipient_domains + ) + ) + + and sender.email.domain.root_domain in $free_email_providers + and any([body.html.inner_text], strings.ilike(., "*mcafee*", "*norton*", "*geek squad*", "*paypal*", "*ebay*", "*symantec*", "*best buy*", "*lifelock*")) + and any([body.html.inner_text], strings.ilike(., "*+1*")) - and 4 of ( - strings.ilike(body.html.inner_text, '*purchase*'), - strings.ilike(body.html.inner_text, '*subscription*'), - strings.ilike(body.html.inner_text, '*antivirus*'), - strings.ilike(body.html.inner_text, '*order*'), - strings.ilike(body.html.inner_text, '*support*'), - strings.ilike(body.html.inner_text, '*receipt*'), - strings.ilike(body.html.inner_text, '*invoice*'), - strings.ilike(body.html.inner_text, '*call*'), - strings.ilike(body.html.inner_text, '*cancel*'), - strings.ilike(body.html.inner_text, '*renew*'), - strings.ilike(body.html.inner_text, '*refund*') - ) -tags: + and 4 of ( + strings.ilike(body.html.inner_text, '*purchase*'), + strings.ilike(body.html.inner_text, '*subscription*'), + strings.ilike(body.html.inner_text, '*antivirus*'), + strings.ilike(body.html.inner_text, '*order*'), + strings.ilike(body.html.inner_text, '*support*'), + strings.ilike(body.html.inner_text, '*receipt*'), + strings.ilike(body.html.inner_text, '*invoice*'), + strings.ilike(body.html.inner_text, '*call*'), + strings.ilike(body.html.inner_text, '*cancel*'), + strings.ilike(body.html.inner_text, '*renew*'), + strings.ilike(body.html.inner_text, '*refund*') + ) +attack_types: - "Callback Phishing" - - "Customer service fraud" +tactics_and_techniques: + - "Free email provider" + - "Impersonation: Brand" + - "Out of band pivot" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Sender analysis" + - "URL analysis" id: "afe5dec2-1ec0-505e-b5dd-768144d71bec" diff --git a/detection-rules/body_html_smuggling_atob_in_body.yml b/detection-rules/body_html_smuggling_atob_in_body.yml index e2ef2a67068..6641ceb145e 100644 --- a/detection-rules/body_html_smuggling_atob_in_body.yml +++ b/detection-rules/body_html_smuggling_atob_in_body.yml @@ -1,5 +1,5 @@ name: "HTML smuggling with atob in message body" -description: | +description: | Detects if the email body HTML contains the document write or insertAdjacentHTML method and atob function call. This technique has been observed leading to credential phishing. type: "rule" @@ -8,7 +8,12 @@ source: | type.inbound and (length(body.plain.raw) < 200 or body.plain.raw is null) and regex.icontains(body.html.raw, "document.{0,10}(write|insertAdjacentHTML).{0,10}atob") -tags: - - "Suspicious body" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "HTML smuggling" +detection_methods: + - "Content analysis" + - "HTML analysis" id: "0f86851f-3ec4-50b6-ba1a-cba096642d0e" diff --git a/detection-rules/body_job_scam_new_sender.yml b/detection-rules/body_job_scam_new_sender.yml index 88dea7186e0..7e4c12ace6f 100644 --- a/detection-rules/body_job_scam_new_sender.yml +++ b/detection-rules/body_job_scam_new_sender.yml @@ -1,6 +1,6 @@ name: "Job Scam (first-time sender)" description: | - Detects job scam attempts by analyzing the email body text from a first-time sender. + Detects job scam attempts by analyzing the email body text from a first-time sender. type: "rule" severity: "low" source: | @@ -25,10 +25,13 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) - -tags: - - "Machine Learning" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" - - "Scam" - - "Suspicious sender" + - "Sender analysis" id: "a37dc32d-33a4-5097-a585-ff6c345d0ecc" diff --git a/detection-rules/body_microsoft_logo_bing_redirect.yml b/detection-rules/body_microsoft_logo_bing_redirect.yml index c10b1517d33..cb7058d8f47 100644 --- a/detection-rules/body_microsoft_logo_bing_redirect.yml +++ b/detection-rules/body_microsoft_logo_bing_redirect.yml @@ -43,12 +43,12 @@ source: | ) ) ) - + // Bing redirect and any(body.links, .href_url.domain.root_domain == 'bing.com' and .href_url.path =~ '/ck/a') - + and sender.email.domain.root_domain not in $org_domains - + and sender.email.domain.root_domain not in ( "bing.com", "microsoft.com", @@ -60,8 +60,17 @@ source: | "sharepointonline.com", "yammer.com" ) -tags: - - "Suspicious content" - - "Brand impersonation" - - "Suspicious link" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Impersonation: Brand" + - "Open redirect" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Content analysis" + - "Header analysis" + - "Natural Language Understanding" + - "Sender analysis" + - "URL analysis" id: "27b8d8d8-a117-5d34-b4b0-9adb7c7c971e" diff --git a/detection-rules/body_unicode_slashes_in_url.yml b/detection-rules/body_unicode_slashes_in_url.yml index 045125689bc..5dfe4f3fe9f 100644 --- a/detection-rules/body_unicode_slashes_in_url.yml +++ b/detection-rules/body_unicode_slashes_in_url.yml @@ -13,6 +13,12 @@ source: | regex.icontains(body.plain.raw, 'https?:\/\/[^\s⁄∕]+(?:\/[^\s⁄∕]+)*[⁄∕][^\s⁄∕]+') or any(body.links, regex.icontains(.href_url.url,'https?:\/\/[^\s⁄∕]+(?:\/[^\s⁄∕]+)*[⁄∕][^\s⁄∕]+')) ) -tags: - - "Suspicious Link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Social engineering" +detection_methods: + - "Content analysis" + - "URL analysis" id: "12069f5b-a774-53ba-8473-633291f71e84" diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml index 252ab8f624a..afda7fa2094 100644 --- a/detection-rules/callback_phishing_nlu_body_or_attachments.yml +++ b/detection-rules/callback_phishing_nlu_body_or_attachments.yml @@ -1,6 +1,6 @@ name: "Callback Phishing NLU body or attachment from first-time sender" description: | - Detects callback scams by analyzing text within images of receipts or invoices from first time senders. + Detects callback scams by analyzing text within images of receipts or invoices from first time senders. type: "rule" severity: "medium" source: | @@ -29,9 +29,15 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Machine Learning" - - "Customer service fraud" - - "Natural Language Understanding" +attack_types: - "Callback Phishing" +tactics_and_techniques: + - "Out of band pivot" + - "Social engineering" +detection_methods: + - "Content analysis" + - "File analysis" + - "Optical Character Recognition" + - "Natural Language Understanding" + - "Sender analysis" id: "b93c6f94-c9a3-587a-8eb5-6856754f8222" diff --git a/detection-rules/cve_2021_40444_external_relationship.yml b/detection-rules/cve_2021_40444_external_relationship.yml index 97c39d974f4..d98db979cbb 100644 --- a/detection-rules/cve_2021_40444_external_relationship.yml +++ b/detection-rules/cve_2021_40444_external_relationship.yml @@ -29,7 +29,17 @@ source: | ) ) tags: - - "Suspicious attachment" - "CVE-2021-40444" - - "Office exploit" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Exploit" + - "Macros" + - "Scripting" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "File analysis" + - "Macro analysis" + - "OLE analysis" id: "8cefcf7f-2a48-5102-9b09-8db995759223" diff --git a/detection-rules/disposable_sender_unsolicited.yml b/detection-rules/disposable_sender_unsolicited.yml index 4cead019139..0da99bbf41f 100644 --- a/detection-rules/disposable_sender_unsolicited.yml +++ b/detection-rules/disposable_sender_unsolicited.yml @@ -8,6 +8,6 @@ source: |- type.inbound and sender.email.domain.root_domain in $disposable_email_providers and sender.email.email not in $recipient_emails -tags: - - "Suspicious sender" +detection_methods: + - "Sender analysis" id: "5436b3db-3f17-5100-8136-1d03fc221fca" diff --git a/detection-rules/file_sharing_link_from_suspicious_sender_domain.yml b/detection-rules/file_sharing_link_from_suspicious_sender_domain.yml index 7bc9c94cc58..bedb767f21f 100644 --- a/detection-rules/file_sharing_link_from_suspicious_sender_domain.yml +++ b/detection-rules/file_sharing_link_from_suspicious_sender_domain.yml @@ -17,9 +17,12 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "File sharing link" - - "Suspicious link" - - "Suspicious sender" - - "Spam" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Free file host" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "95f20354-3091-537e-9fe0-80ea8b64913b" diff --git a/detection-rules/file_sharing_link_suspicious_subject.yml b/detection-rules/file_sharing_link_suspicious_subject.yml index cf4077a8441..ff3c735beee 100644 --- a/detection-rules/file_sharing_link_suspicious_subject.yml +++ b/detection-rules/file_sharing_link_suspicious_subject.yml @@ -19,8 +19,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "File sharing link" - - "Suspicious link" - - "Suspicious subject" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Free file host" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" + - "URL analysis" id: "a306e2a6-addc-5e26-9be1-c146f37fd7f2" diff --git a/detection-rules/headers_anonymousfox.yml b/detection-rules/headers_anonymousfox.yml index fa8ddf64fb9..3b1e379309b 100644 --- a/detection-rules/headers_anonymousfox.yml +++ b/detection-rules/headers_anonymousfox.yml @@ -13,6 +13,11 @@ source: | regex.icontains(.name, "X-Authenticated-Sender|X-Sender") and regex.icontains(.value, "(anonymous|smtp)fox-")) or regex.icontains(sender.email.email, "(anonymous|smtp)fox-")) -tags: - - "Suspicious headers" +attack_types: + - "BEC/Fraud" + - "Credential Phishing" + - "Malware/Ransomware" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "2506206e-b879-57fa-bcfd-95c66eb02db8" diff --git a/detection-rules/headers_bec_masked_recipients_no_links_freemail_replyto.yml b/detection-rules/headers_bec_masked_recipients_no_links_freemail_replyto.yml index fe567a322cc..782509a0586 100644 --- a/detection-rules/headers_bec_masked_recipients_no_links_freemail_replyto.yml +++ b/detection-rules/headers_bec_masked_recipients_no_links_freemail_replyto.yml @@ -7,18 +7,18 @@ type: "rule" severity: "medium" source: | type.inbound - + and any(recipients.to, .email.email == sender.email.email) and length(recipients.cc) == 0 and length(recipients.bcc) == 0 - + and length(body.links) == 0 - + and any(headers.reply_to, .email.domain.domain in $free_email_providers and not .email.domain.domain == sender.email.domain.domain ) - + and ( ( sender.email.domain.root_domain in $free_email_providers @@ -29,8 +29,12 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious sender" - - "Suspicious headers" - - "Business Email Compromise" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Evasion" + - "Free email provider" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "682191bf-a623-5f03-a497-9b8590535697" diff --git a/detection-rules/headers_freemail_replyto_returnpath_mismatch.yml b/detection-rules/headers_freemail_replyto_returnpath_mismatch.yml index 8750cbbc14a..b1a481f76ad 100644 --- a/detection-rules/headers_freemail_replyto_returnpath_mismatch.yml +++ b/detection-rules/headers_freemail_replyto_returnpath_mismatch.yml @@ -17,8 +17,15 @@ source: | ) ) and sender.email.domain.root_domain not in $free_email_providers -tags: - - "Suspicious sender" - - "Business Email Compromise" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Evasion" + - "Free email provider" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" + - "Sender analysis" id: "83e5e2df-7049-5990-b20d-1ff6bc6fd6f0" diff --git a/detection-rules/headers_invalid_ios_build.yml b/detection-rules/headers_invalid_ios_build.yml index 4b7fa27f9cb..1f962733e94 100644 --- a/detection-rules/headers_invalid_ios_build.yml +++ b/detection-rules/headers_invalid_ios_build.yml @@ -7,7 +7,12 @@ source: | type.inbound and regex.contains(headers.mailer, '(iPad|iPhone) Mail') and not regex.contains(headers.mailer, '(iPad|iPhone) Mail \([0-9]{2}') -tags: - - "Suspicious headers" - - "Suspicious sender" +attack_types: + - "BEC/Fraud" + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Header analysis" id: "e0b74072-3210-5511-9ad9-2c945ab28abb" diff --git a/detection-rules/headers_php_mailer_with_common_phishing_attachments.yml b/detection-rules/headers_php_mailer_with_common_phishing_attachments.yml index adb5df9970d..ea173528ddf 100644 --- a/detection-rules/headers_php_mailer_with_common_phishing_attachments.yml +++ b/detection-rules/headers_php_mailer_with_common_phishing_attachments.yml @@ -11,7 +11,10 @@ source: | type.inbound and strings.ilike(headers.mailer, '*phpmailer*') and any(attachments, .file_name in~ ('image.png', 'name.png', 'use.png')) -tags: - - "Suspicious attachment" - - "PHP mailer" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Image as content" +detection_methods: + - "Header analysis" id: "07e03563-88f6-5d2f-8730-7d17f860ba14" diff --git a/detection-rules/headers_replyto_new_domain_nlu_request.yml b/detection-rules/headers_replyto_new_domain_nlu_request.yml index 23f5616fb1f..c477612dfd6 100644 --- a/detection-rules/headers_replyto_new_domain_nlu_request.yml +++ b/detection-rules/headers_replyto_new_domain_nlu_request.yml @@ -46,8 +46,15 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Vendor impersonation" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" - - "New domain" + - "Sender analysis" + - "URL analysis" + - "Whois" id: "db4d9bb3-0eca-5525-9a99-7c1c773b580f" diff --git a/detection-rules/headers_russia_return_path.yml b/detection-rules/headers_russia_return_path.yml index 23356c7d392..1e3c6025da9 100644 --- a/detection-rules/headers_russia_return_path.yml +++ b/detection-rules/headers_russia_return_path.yml @@ -17,7 +17,11 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Suspicious headers" - +attack_types: + - "BEC/Fraud" + - "Credential Phishing" + - "Malware/Ransomware" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "588b3954-c03a-57fb-b5a4-abf993a8c003" diff --git a/detection-rules/headers_sendgrid_onmicrosoft.yml b/detection-rules/headers_sendgrid_onmicrosoft.yml index bb309b8d40b..b8daac8b4de 100644 --- a/detection-rules/headers_sendgrid_onmicrosoft.yml +++ b/detection-rules/headers_sendgrid_onmicrosoft.yml @@ -9,6 +9,10 @@ source: | type.inbound and headers.return_path.domain.domain == "sendgrid.net" and sender.email.domain.root_domain == "onmicrosoft.com" -tags: - - "Suspicious headers" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Header analysis" id: "271f4ae9-9681-5d61-a94d-8fa714db826d" diff --git a/detection-rules/headers_spf_temp_error.yml b/detection-rules/headers_spf_temp_error.yml index f3734667407..d237245ed1e 100644 --- a/detection-rules/headers_spf_temp_error.yml +++ b/detection-rules/headers_spf_temp_error.yml @@ -14,6 +14,8 @@ severity: "medium" source: | type.inbound and any(headers.hops, any(.fields, strings.ilike(.name, "Received-SPF") and strings.ilike(.value, "*spf=temperror*"))) -tags: - - "Suspicious headers" +tactics_and_techniques: + - "Spoofing" +detection_methods: + - "Header analysis" id: "2df7e839-8ffb-5d84-ac87-a45239d0d24b" diff --git a/detection-rules/headers_voicemail_sendgrid.yml b/detection-rules/headers_voicemail_sendgrid.yml index 0c455dcbabd..149daddbc12 100644 --- a/detection-rules/headers_voicemail_sendgrid.yml +++ b/detection-rules/headers_voicemail_sendgrid.yml @@ -9,6 +9,11 @@ source: | type.inbound and headers.return_path.domain.domain == 'sendgrid.net' and strings.ilike(subject.subject, '*voicemail*', '*voice message*') -tags: - - "Suspicious headers" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" id: "21cad89c-55e0-5cf1-8677-bf0242633a82" diff --git a/detection-rules/headers_zimbra_mailer_unsupported_os_versions.yml b/detection-rules/headers_zimbra_mailer_unsupported_os_versions.yml index b00f78cb53e..d471fa194af 100644 --- a/detection-rules/headers_zimbra_mailer_unsupported_os_versions.yml +++ b/detection-rules/headers_zimbra_mailer_unsupported_os_versions.yml @@ -8,6 +8,6 @@ source: | type.inbound and strings.starts_with(headers.mailer, "Zimbra") and regex.icontains(headers.mailer, '\b(5\.1|6\.1)\.\d{4}\b') -tags: - - "Suspicious sender" +detection_methods: + - "Header analysis" id: "d23e694f-a23d-5730-9a04-29629f2e6696" diff --git a/detection-rules/impersonation_adp.yml b/detection-rules/impersonation_adp.yml index 87c6e792dae..f42224d5045 100644 --- a/detection-rules/impersonation_adp.yml +++ b/detection-rules/impersonation_adp.yml @@ -10,7 +10,12 @@ source: | and sender.display_name in~ ('RS-Plan-Admin@adp.com','ADP','SecurityServices_NoReply@adp.com') and sender.email.domain.root_domain not in~ ('adp.com', 'adpsurveys.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "bb9cf46b-188e-58f5-996e-b35caf2423a2" diff --git a/detection-rules/impersonation_amazon.yml b/detection-rules/impersonation_amazon.yml index 8ebdcaa4fec..8e15f87b5b3 100644 --- a/detection-rules/impersonation_amazon.yml +++ b/detection-rules/impersonation_amazon.yml @@ -44,7 +44,12 @@ source: | ) and sender.email.email not in $recipient_emails and sender.email.domain.domain not in $org_domains -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "13fc967d-4cc6-501d-9637-8c0761a1a354" diff --git a/detection-rules/impersonation_amazon_suspicious_text.yml b/detection-rules/impersonation_amazon_suspicious_text.yml index 70be5908e8f..537fd7cd1f3 100644 --- a/detection-rules/impersonation_amazon_suspicious_text.yml +++ b/detection-rules/impersonation_amazon_suspicious_text.yml @@ -60,8 +60,16 @@ source: | 'amazonpay.com', 'synchronybank.com', ) -tags: - - "Brand impersonation" - - "Suspicious sender" - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "File analysis" + - "Header analysis" + - "Natural Language Understanding" + - "Optical Character Recognition" + - "Sender analysis" id: "5751dcb9-071d-540b-9ec3-410d6aa80c11" diff --git a/detection-rules/impersonation_amex.yml b/detection-rules/impersonation_amex.yml index 1185c91cbcb..8cad2868b4b 100644 --- a/detection-rules/impersonation_amex.yml +++ b/detection-rules/impersonation_amex.yml @@ -15,7 +15,13 @@ source: | and sender.email.domain.root_domain not in ('aexp.com','americanexpress.com', 'americanexpress.co.uk', 'aexpfeedback.com', 'amexnetwork.com', 'accountonline.com', 'transunion.com', 'amexgiftcard.com', 'amexgbt.com') and sender.email.domain.domain not in ('accountprotection.microsoft.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "992a9fa9-84ee-5065-8486-b3a2a8ffa676" diff --git a/detection-rules/impersonation_apple.yml b/detection-rules/impersonation_apple.yml index e44dd8a97b8..c341f889b6f 100644 --- a/detection-rules/impersonation_apple.yml +++ b/detection-rules/impersonation_apple.yml @@ -13,7 +13,12 @@ source: | ) and sender.email.domain.root_domain !~ 'apple.com' and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "0b17f2c2-e100-5d51-b53e-ee3da0431f1d" diff --git a/detection-rules/impersonation_bank_of_america.yml b/detection-rules/impersonation_bank_of_america.yml index 3b12bf58530..7487e05a17d 100644 --- a/detection-rules/impersonation_bank_of_america.yml +++ b/detection-rules/impersonation_bank_of_america.yml @@ -14,7 +14,13 @@ source: | ) and sender.email.domain.root_domain not in~ ('bankofamerica.com', 'transunion.com', 'bofa.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "d2fc6ea1-0c8d-57e0-bcaa-732a2e6b76e4" diff --git a/detection-rules/impersonation_barracuda.yml b/detection-rules/impersonation_barracuda.yml index 8d17082e960..f8e419f29d0 100644 --- a/detection-rules/impersonation_barracuda.yml +++ b/detection-rules/impersonation_barracuda.yml @@ -22,7 +22,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "583fd5eb-ebd1-5753-944c-1d85f2a82348" diff --git a/detection-rules/impersonation_binance.yml b/detection-rules/impersonation_binance.yml index f6e73b6236a..33be6a6de61 100644 --- a/detection-rules/impersonation_binance.yml +++ b/detection-rules/impersonation_binance.yml @@ -33,7 +33,18 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +tags: + - "Cryptocurrency" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" + - "HTML analysis" + - "Natural Language Understanding" + - "Sender analysis" id: "c3302a76-ff5f-5619-b806-2bfec382f588" diff --git a/detection-rules/impersonation_blockchain.yml b/detection-rules/impersonation_blockchain.yml index d1d8760bd45..fd59c27b031 100644 --- a/detection-rules/impersonation_blockchain.yml +++ b/detection-rules/impersonation_blockchain.yml @@ -14,7 +14,13 @@ source: | and any(distinct(headers.hops, .received_spf.verdict is not null), strings.like(.received_spf.verdict, "*fail")) and sender.email.domain.root_domain not in~ ('blockchain.com', 'wxblockchain.com', 'ai-blockchain.com', 'envisionblockchain.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "0d85e555-bf7c-50a9-afba-de3c67818b6f" diff --git a/detection-rules/impersonation_chase.yml b/detection-rules/impersonation_chase.yml index 9c8edd043d9..192655c7548 100644 --- a/detection-rules/impersonation_chase.yml +++ b/detection-rules/impersonation_chase.yml @@ -18,7 +18,13 @@ source: | ) and sender.email.domain.root_domain not in~ ('chase.com', 'united.com', 'transunion.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "c680f1e7-01b9-5b95-897b-65957f4a57aa" diff --git a/detection-rules/impersonation_coinbase.yml b/detection-rules/impersonation_coinbase.yml index 2bf431822bf..cd6b5a13235 100644 --- a/detection-rules/impersonation_coinbase.yml +++ b/detection-rules/impersonation_coinbase.yml @@ -29,6 +29,14 @@ source: | ) ) tags: - - "Brand impersonation" - - "Suspicious sender" + - "Cryptocurrency" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "3dca757a-fb21-53c0-ac17-b0f110e8db60" diff --git a/detection-rules/impersonation_dhl.yml b/detection-rules/impersonation_dhl.yml index bb376f9f0ff..d5cd44d8299 100644 --- a/detection-rules/impersonation_dhl.yml +++ b/detection-rules/impersonation_dhl.yml @@ -25,7 +25,13 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "be4b4ae0-d393-5f8b-b984-5cf4ad7cbeb5" diff --git a/detection-rules/impersonation_digital_ocean.yml b/detection-rules/impersonation_digital_ocean.yml index 116804a606e..a3ca8088647 100644 --- a/detection-rules/impersonation_digital_ocean.yml +++ b/detection-rules/impersonation_digital_ocean.yml @@ -12,7 +12,13 @@ source: | ) and sender.email.domain.root_domain !~ 'digitalocean.com' and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "7f2f0e97-b89f-54dd-9167-cbf1e55b112b" diff --git a/detection-rules/impersonation_docusign.yml b/detection-rules/impersonation_docusign.yml index fbd7000378a..2af461dce5a 100644 --- a/detection-rules/impersonation_docusign.yml +++ b/detection-rules/impersonation_docusign.yml @@ -62,7 +62,15 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Brand impersonation" - - "DocuSign" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" + - "Spoofing" +detection_methods: + - "Header analysis" + - "Sender analysis" + - "URL analysis" id: "4d29235c-08b9-5f9b-950e-60b05c4691fb" diff --git a/detection-rules/impersonation_domain_replyto_freemail_lookalike_financial_request.yml b/detection-rules/impersonation_domain_replyto_freemail_lookalike_financial_request.yml index 2c92c535988..09a34f1c365 100644 --- a/detection-rules/impersonation_domain_replyto_freemail_lookalike_financial_request.yml +++ b/detection-rules/impersonation_domain_replyto_freemail_lookalike_financial_request.yml @@ -24,9 +24,14 @@ source: | and any(ml.nlu_classifier(.).intents, .name != "benign") ) ) -tags: - - "Domain Impersonation" - - "Suspicious ReplyTo" - - "Machine Learning" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free email provider" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" + - "Sender analysis" id: "43026a40-4285-51a7-a42e-f08b9ee41b97" diff --git a/detection-rules/impersonation_dropbox.yml b/detection-rules/impersonation_dropbox.yml index 2bc4d671335..870e402b031 100644 --- a/detection-rules/impersonation_dropbox.yml +++ b/detection-rules/impersonation_dropbox.yml @@ -17,7 +17,14 @@ source: | ) ) and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Sender analysis" id: "61f11d12-7033-53c9-a95a-df982ff31c4b" diff --git a/detection-rules/impersonation_employee_payroll_fraud.yml b/detection-rules/impersonation_employee_payroll_fraud.yml index 55d7d741d01..c8e01b2286f 100644 --- a/detection-rules/impersonation_employee_payroll_fraud.yml +++ b/detection-rules/impersonation_employee_payroll_fraud.yml @@ -14,7 +14,7 @@ source: | or sender.email.domain.root_domain in $free_email_providers ) - + and 1 of ( regex.icontains(body.plain.raw, '(pay\s?(roll|check|date|day)|direct deposit|\bdd\b|gehalt|salario|salary)'), regex.icontains(body.html.inner_text, '(pay\s?(roll|check|date|day)|direct deposit|\bdd\b|gehalt|salario|salary)'), @@ -30,7 +30,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Payroll fraud" - - "Employee impersonation" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Impersonation: Employee" + - "Free email provider" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Sender analysis" id: "2beb7d85-dfe3-5ecc-9b2a-d7416a3ef992" diff --git a/detection-rules/impersonation_employee_subject.yml b/detection-rules/impersonation_employee_subject.yml index d9009361063..d46d07f0d5a 100644 --- a/detection-rules/impersonation_employee_subject.yml +++ b/detection-rules/impersonation_employee_subject.yml @@ -1,6 +1,6 @@ name: "BEC: Employee impersonation with subject manipulation" description: | - Subject matches the display name of someone in your organization, and the body resembles a BEC attack. + Subject matches the display name of someone in your organization, and the body resembles a BEC attack. type: "rule" severity: "medium" source: | @@ -29,10 +29,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Employee impersonation" - - "Suspicious sender" - - "Machine Learning" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Impersonation: Employee" + - "Social engineering" +detection_methods: + - "Content analysis" - "Natural Language Understanding" - - "Business Email Compromise" + - "Sender analysis" id: "9adfc77b-cabe-5ef8-b1ed-6ad5d682447f" diff --git a/detection-rules/impersonation_employee_urgent_request.yml b/detection-rules/impersonation_employee_urgent_request.yml index caf165cfd2e..5c52c9b98f9 100644 --- a/detection-rules/impersonation_employee_urgent_request.yml +++ b/detection-rules/impersonation_employee_urgent_request.yml @@ -1,8 +1,8 @@ name: "Employee impersonation with urgent request (first-time sender)" description: | - Sender is using a display name that matches the display name of someone in your organization. + Sender is using a display name that matches the display name of someone in your organization. - Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body first-time senders. + Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body first-time senders. type: "rule" severity: "medium" source: | @@ -33,9 +33,14 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Employee impersonation" - - "Suspicious sender" - - "Machine Learning" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Impersonation: Employee" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" + - "Sender analysis" id: "1ce9a146-1293-531e-bb02-0af7ad1b018e" diff --git a/detection-rules/impersonation_exodus.yml b/detection-rules/impersonation_exodus.yml index b47e1938e70..4704dc61445 100644 --- a/detection-rules/impersonation_exodus.yml +++ b/detection-rules/impersonation_exodus.yml @@ -15,6 +15,14 @@ source: | or any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .text == "wallet") ) tags: - - "Brand impersonation" - "Cryptocurrency" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Natural Language Understanding" + - "Sender analysis" id: "40c77ecc-782d-595a-a042-7fe7e4d756ee" diff --git a/detection-rules/impersonation_facebook.yml b/detection-rules/impersonation_facebook.yml index 02a9f03b206..b27ebe9629d 100644 --- a/detection-rules/impersonation_facebook.yml +++ b/detection-rules/impersonation_facebook.yml @@ -15,7 +15,13 @@ source: | ) and sender.email.domain.root_domain not in~ ('facebook.com','facebookmail.com', 'eventsatfacebook.com', 'facebookenterprise.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "e38f1e3b-79be-5a59-b084-24a851daf6b9" diff --git a/detection-rules/impersonation_fake_msg_thread_mismatched_from_freemail_replyto.yml b/detection-rules/impersonation_fake_msg_thread_mismatched_from_freemail_replyto.yml index f4ff77857fa..1834add8b97 100644 --- a/detection-rules/impersonation_fake_msg_thread_mismatched_from_freemail_replyto.yml +++ b/detection-rules/impersonation_fake_msg_thread_mismatched_from_freemail_replyto.yml @@ -2,49 +2,55 @@ name: "Fake Message Thread - First Time Sender with a Mismatched Freemail Reply- description: | Fake Message Threads or Chain Reuse is a common confidence technique exploited by threat actors to bolster credibility. This is typically used in conjunction with a reply-to address that is not the same as the sender address. -references: +references: - "https://playground.sublimesecurity.com?id=5ab9a225-4de3-494f-9a55-e16ec9e1e5c3" type: "rule" severity: "medium" source: | - type.inbound + type.inbound - // First-time sender - and ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $sender_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $sender_domains - ) - ) + // First-time sender + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) + ) - // Reply-to is a freemail sender but From is not - and any(headers.reply_to, - .email.domain.domain in $free_email_providers - and not .email.domain.domain == sender.email.domain.domain - ) + // Reply-to is a freemail sender but From is not + and any(headers.reply_to, + .email.domain.domain in $free_email_providers + and not .email.domain.domain == sender.email.domain.domain + ) - // Exclude marketing emails - and not strings.ilike(sender.email.local_part, "support", "sales", "noreply", "marketing") + // Exclude marketing emails + and not strings.ilike(sender.email.local_part, "support", "sales", "noreply", "marketing") - // Check for Message Thread Indicators - and ( - strings.istarts_with(subject.subject, "RE:") - or any([body.plain.raw, body.html.display_text], - regex.icontains(.,"From:[ a-z0-9<>_@\\.]{0,80}Sent:[ a-z0-9<>_@\\.:]{0,40}To:[ a-z0-9<>_@\\.;]{0,300}(Cc:)?.{0,300}Subject:") - ) + // Check for Message Thread Indicators + and ( + strings.istarts_with(subject.subject, "RE:") + or any([body.plain.raw, body.html.display_text], + regex.icontains(.,"From:[ a-z0-9<>_@\\.]{0,80}Sent:[ a-z0-9<>_@\\.:]{0,40}To:[ a-z0-9<>_@\\.;]{0,300}(Cc:)?.{0,300}Subject:") + ) - ) + ) - // Check for the Presence of References or In-Reply-To properties - and ( - length(headers.references) == 0 - or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To"))) - ) -tags: - - "Contact impersonation" - - "Fake Message Thread" + // Check for the Presence of References or In-Reply-To properties + and ( + length(headers.references) == 0 + or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To"))) + ) +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Free email provider" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Sender analysis" id: "ca64e819-576b-574a-abcc-63f1916e8a41" diff --git a/detection-rules/impersonation_fake_shipping_notification.yml b/detection-rules/impersonation_fake_shipping_notification.yml index 06cafd32acf..7b003eb09ba 100644 --- a/detection-rules/impersonation_fake_shipping_notification.yml +++ b/detection-rules/impersonation_fake_shipping_notification.yml @@ -1,7 +1,7 @@ name: "Fake shipping notification with link to free file hosting" description: | This rule detects spam emails impersonating FedEx, UPS, or USPS with links to free file hosting. -references: +references: - "https://playground.sublimesecurity.com?id=64feb22a-03e8-4d8f-83f6-a828dc5e3540" severity: "low" type: "rule" @@ -26,7 +26,14 @@ source: | ) or sender.email.domain.valid == false ) -tags: +attack_types: - "Spam" - - "Brand impersonation" +tactics_and_techniques: + - "Free file host" + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Sender analysis" id: "6d3fe05e-8ee6-586e-a2c6-60488ecf347a" diff --git a/detection-rules/impersonation_fedex.yml b/detection-rules/impersonation_fedex.yml index ce5e54f3af0..a6b9412cfac 100644 --- a/detection-rules/impersonation_fedex.yml +++ b/detection-rules/impersonation_fedex.yml @@ -15,7 +15,13 @@ source: | // sedex.com is not affiliated with FedEx, but is an apparent FP and sender.email.domain.root_domain not in~ ('fedex.com', 'sedex.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "94a2b602-2bc1-5ea3-941e-752e3a2235cf" diff --git a/detection-rules/impersonation_finra.yml b/detection-rules/impersonation_finra.yml index 077d679bded..d31b31cae3e 100644 --- a/detection-rules/impersonation_finra.yml +++ b/detection-rules/impersonation_finra.yml @@ -25,7 +25,13 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "15c81db4-b3ba-5e9a-978c-194f77b56739" diff --git a/detection-rules/impersonation_github.yml b/detection-rules/impersonation_github.yml index 95532ee6232..138e6d21d85 100644 --- a/detection-rules/impersonation_github.yml +++ b/detection-rules/impersonation_github.yml @@ -25,7 +25,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "9402f92b-f2b1-5452-8124-fdad4a88feb4" diff --git a/detection-rules/impersonation_google_via_msft_forms.yml b/detection-rules/impersonation_google_via_msft_forms.yml index f955466bd32..c8890d2b6b5 100644 --- a/detection-rules/impersonation_google_via_msft_forms.yml +++ b/detection-rules/impersonation_google_via_msft_forms.yml @@ -14,7 +14,14 @@ source: | any(body.links, .href_url.domain.root_domain not in $tranco_1m) or strings.ilike(body.html.display_text, "*suspicious activities*", "*failure to secure*", "*loose your*", "*suspended*") ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Sender analysis" id: "1daac608-66f7-5d0a-ab0f-ff9902ddabb7" diff --git a/detection-rules/impersonation_gusto.yml b/detection-rules/impersonation_gusto.yml index 7ca3ec295d9..3c7312fe349 100644 --- a/detection-rules/impersonation_gusto.yml +++ b/detection-rules/impersonation_gusto.yml @@ -15,7 +15,15 @@ source: | and .confidence in ("medium", "high")) and sender.email.domain.root_domain !~ 'gusto.com' and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Computer vision" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Content analysis" + - "Header analysis" + - "Sender analysis" id: "54025c1c-34bc-5cbf-97b8-d544806fc587" diff --git a/detection-rules/impersonation_human_resources.yml b/detection-rules/impersonation_human_resources.yml index 0dc695bcd9c..b3496282108 100644 --- a/detection-rules/impersonation_human_resources.yml +++ b/detection-rules/impersonation_human_resources.yml @@ -6,9 +6,9 @@ source: | type.inbound and sender.email.domain.domain not in $org_domains and regex.icontains(sender.display_name, '(\bh\W?r\W?\b|human resources|hr depart(ment)?|employee relations)') - + and (length(body.links) > 0 or length(attachments) > 0) - + // Request and Urgency and any(ml.nlu_classifier(body.html.inner_text).entities, .name == "request") and any(ml.nlu_classifier(body.html.inner_text).entities, .name == "urgency") @@ -19,8 +19,8 @@ source: | ) or length(ml.nlu_classifier(body.html.inner_text).intents) == 0 ) - - + + and ( ( sender.email.domain.root_domain in $free_email_providers @@ -32,6 +32,15 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Department impersonation" +attack_types: + - "BEC/Fraud" + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Employee" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Natural Language Understanding" + - "Sender analysis" id: "8c95a6a8-50d3-5697-a379-c00bda8e1922" diff --git a/detection-rules/impersonation_ledger.yml b/detection-rules/impersonation_ledger.yml index 7f7a46c6019..0f5b09331be 100644 --- a/detection-rules/impersonation_ledger.yml +++ b/detection-rules/impersonation_ledger.yml @@ -38,7 +38,14 @@ source: | ) ) tags: - - "Brand impersonation" - "Cryptocurrency" - - "Ledger" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "5f934755-cd03-5f4c-a5bd-a8899e7108c1" diff --git a/detection-rules/impersonation_linkedin.yml b/detection-rules/impersonation_linkedin.yml index e75e5063796..8c0e3ab07d7 100644 --- a/detection-rules/impersonation_linkedin.yml +++ b/detection-rules/impersonation_linkedin.yml @@ -14,7 +14,13 @@ source: | ) and sender.email.domain.root_domain !~ 'linkedin.com' and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "1a0cde6d-ce91-575f-a6a4-7a88b12f2ca4" diff --git a/detection-rules/impersonation_microsoft.yml b/detection-rules/impersonation_microsoft.yml index 803d24e2b20..c36840119f0 100644 --- a/detection-rules/impersonation_microsoft.yml +++ b/detection-rules/impersonation_microsoft.yml @@ -1,10 +1,10 @@ name: "Brand impersonation: Microsoft" description: | - Impersonation of the Microsoft brand. + Impersonation of the Microsoft brand. references: - - "https://www.itproportal.com/news/cybercriminals-launch-targeted-phishing-attacks-against-microsoft-365-users/" - - "https://cofense.com/blog/office-365-phishing-variant/" - - "https://www.helpnetsecurity.com/2020/05/04/fake-microsoft-teams-notification/" + - "https://www.itproportal.com/news/cybercriminals-launch-targeted-phishing-attacks-against-microsoft-365-users/" + - "https://cofense.com/blog/office-365-phishing-variant/" + - "https://www.helpnetsecurity.com/2020/05/04/fake-microsoft-teams-notification/" type: "rule" severity: "high" authors: @@ -45,7 +45,12 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Sender analysis" id: "6e2f04e6-b607-5e36-9015-d39c98265579" diff --git a/detection-rules/impersonation_microsoft_quarantine.yml b/detection-rules/impersonation_microsoft_quarantine.yml index 00917fe743d..2b7b1927e12 100644 --- a/detection-rules/impersonation_microsoft_quarantine.yml +++ b/detection-rules/impersonation_microsoft_quarantine.yml @@ -32,8 +32,18 @@ source: | "sharepointonline.com", "yammer.com", ) -tags: - - "Brand impersonation" - - "Suspicious content" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free file host" + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Content analysis" + - "File analysis" + - "Header analysis" - "Natural Language Understanding" + - "Optical Character Recognition" + - "Sender analysis" id: "185db6b3-b35c-578d-bd9f-dab0703288fe" diff --git a/detection-rules/impersonation_microsoft_teams.yml b/detection-rules/impersonation_microsoft_teams.yml index 60eb376829e..4b56e2189cc 100644 --- a/detection-rules/impersonation_microsoft_teams.yml +++ b/detection-rules/impersonation_microsoft_teams.yml @@ -1,6 +1,6 @@ name: "Brand impersonation: Microsoft Teams" description: | - Impersonation of a Microsoft Teams message. + Impersonation of a Microsoft Teams message. type: "rule" severity: "high" source: | @@ -12,6 +12,14 @@ source: | ) ) and sender.email.domain.root_domain not in ("microsoft.com", "microsoftsupport.com", "office.com") -tags: - - "Brand impersonation" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "File analysis" + - "Optical Character Recognition" + - "Sender analysis" id: "9cd53055-8e1a-5a45-b78f-34a62f0793dd" diff --git a/detection-rules/impersonation_netflix.yml b/detection-rules/impersonation_netflix.yml index 574410929fc..deb0c71ce17 100644 --- a/detection-rules/impersonation_netflix.yml +++ b/detection-rules/impersonation_netflix.yml @@ -16,7 +16,13 @@ source: | ) and sender.email.domain.root_domain !~ 'netflix.com' and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "9f39eea5-2edf-524d-b68b-d8d0bdb74273" diff --git a/detection-rules/impersonation_norton_lifelock.yml b/detection-rules/impersonation_norton_lifelock.yml index 634b31e9e2c..2cb0864b1be 100644 --- a/detection-rules/impersonation_norton_lifelock.yml +++ b/detection-rules/impersonation_norton_lifelock.yml @@ -44,7 +44,15 @@ source: | ) ) -tags: - - "Brand impersonation" - - "Suspicious attachment" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free email provider" + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Sender analysis" id: "32bd9efd-67ba-54e2-81d0-89cf16e85a70" diff --git a/detection-rules/impersonation_outlook.yml b/detection-rules/impersonation_outlook.yml index 1e54faba910..1af429a1fbb 100644 --- a/detection-rules/impersonation_outlook.yml +++ b/detection-rules/impersonation_outlook.yml @@ -9,7 +9,13 @@ source: | and regex.icontains(sender.email.domain.domain, '.*outlook.com.+') and sender.email.domain.root_domain != 'outlook.com.au' and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "1fe5bf7b-c4e8-5f8e-a2d7-07e32bd9678f" diff --git a/detection-rules/impersonation_paypal.yml b/detection-rules/impersonation_paypal.yml index 68c42ee68df..d15b6c23e8a 100644 --- a/detection-rules/impersonation_paypal.yml +++ b/detection-rules/impersonation_paypal.yml @@ -63,7 +63,16 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Sender analysis" id: "a6b2ceee-ea57-594d-8437-698fad55c9bf" diff --git a/detection-rules/impersonation_recipient_domain.yml b/detection-rules/impersonation_recipient_domain.yml index 0f3c7c09dd0..eedf925ca66 100644 --- a/detection-rules/impersonation_recipient_domain.yml +++ b/detection-rules/impersonation_recipient_domain.yml @@ -18,7 +18,7 @@ source: | // recipient's domain is in the sender's display name and strings.icontains(sender.display_name, .email.domain.root_domain)) - + and not ( strings.contains(sender.display_name, "on behalf of") and sender.email.domain.root_domain == "microsoftonline.com" @@ -35,6 +35,11 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "63e5808a-ab9a-5112-bc41-545db8c0afd2" diff --git a/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml b/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml index 112256164e9..55bf067c41c 100644 --- a/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml +++ b/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml @@ -1,5 +1,6 @@ name: "Impersonation: Recipient SLD in sender's email address local part" type: "rule" +severity: "low" description: | The sender's email address local part contains the recipients SLD, the sender's domain is not a known org domain, and it's a first time sender. @@ -17,8 +18,11 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -severity: "low" -tags: - - "Organization impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "926f3b53-415c-590e-b5f7-a15c6d9e62c2" diff --git a/detection-rules/impersonation_ripple.yml b/detection-rules/impersonation_ripple.yml index 5ecf978e7e2..69176a1177c 100644 --- a/detection-rules/impersonation_ripple.yml +++ b/detection-rules/impersonation_ripple.yml @@ -21,6 +21,12 @@ source: | ) ) tags: - - "Brand impersonation" - "Cryptocurrency" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "68b39736-70e0-5bf7-8a0a-3e2206552251" diff --git a/detection-rules/impersonation_sharepoint_body_credential_theft.yml b/detection-rules/impersonation_sharepoint_body_credential_theft.yml index 17c7267a323..d3252dd7cd1 100644 --- a/detection-rules/impersonation_sharepoint_body_credential_theft.yml +++ b/detection-rules/impersonation_sharepoint_body_credential_theft.yml @@ -11,10 +11,15 @@ source: | and any(ml.logo_detect(.).brands, .name == "Microsoft SharePoint") ) and any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "cred_theft") -tags: +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: - "Computer Vision" + - "Content analysis" + - "File analysis" - "Natural Language Understanding" - - "Suspicious content" - - "Brand impersonation" - - "Credential phishing" + - "Sender analysis" id: "284b1b70-8daa-5adf-9df8-15d4c6b5ead9" diff --git a/detection-rules/impersonation_sharepoint_image_credential_theft.yml b/detection-rules/impersonation_sharepoint_image_credential_theft.yml index 74fc155eac4..cb947d11466 100644 --- a/detection-rules/impersonation_sharepoint_image_credential_theft.yml +++ b/detection-rules/impersonation_sharepoint_image_credential_theft.yml @@ -17,9 +17,17 @@ source: | ) ) ) -tags: +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Image as content" + - "Social engineering" +detection_methods: - "Computer Vision" + - "File analysis" + - "Header analysis" - "Natural Language Understanding" - - "Brand impersonation" - - "Credential phishing" + - "Optical Character Recognition" + - "Sender analysis" id: "0ac51b9a-7a2a-5be2-9e04-f71b9bfd61ac" diff --git a/detection-rules/impersonation_siliconvalleybank.yml b/detection-rules/impersonation_siliconvalleybank.yml index bd1731c80dc..fef5f14f685 100644 --- a/detection-rules/impersonation_siliconvalleybank.yml +++ b/detection-rules/impersonation_siliconvalleybank.yml @@ -9,6 +9,13 @@ source: | or strings.ilevenshtein(sender.display_name, 'svb') <= 1 ) and beta.whois(sender.email.domain).days_old <= 30 -tags: -- "Brand impersonation" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Sender analysis" + - "Whois" id: "a01f61d9-a01a-548c-9a48-49f8d3732d05" diff --git a/detection-rules/impersonation_spotify.yml b/detection-rules/impersonation_spotify.yml index 3a4d51903c5..4e982b24716 100644 --- a/detection-rules/impersonation_spotify.yml +++ b/detection-rules/impersonation_spotify.yml @@ -25,7 +25,12 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "70e80f91-179d-51dc-9bbd-75f1bc6f9bb3" diff --git a/detection-rules/impersonation_stellar.yml b/detection-rules/impersonation_stellar.yml index 90fffb5a1d5..898f25f88ee 100644 --- a/detection-rules/impersonation_stellar.yml +++ b/detection-rules/impersonation_stellar.yml @@ -21,6 +21,12 @@ source: | ) ) tags: - - "Brand impersonation" - "Cryptocurrency" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "2af9ab94-77b2-5bf9-89f5-5206ee214d57" diff --git a/detection-rules/impersonation_sublime_security.yml b/detection-rules/impersonation_sublime_security.yml index 5c0169e1194..b1dd99c3ad9 100644 --- a/detection-rules/impersonation_sublime_security.yml +++ b/detection-rules/impersonation_sublime_security.yml @@ -28,9 +28,12 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Brand impersonation" - - "Contact impersonation" - - "Executive impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "949484ed-c774-5f53-b91f-cd02ee6104f9" diff --git a/detection-rules/impersonation_turbotax.yml b/detection-rules/impersonation_turbotax.yml index c8d1cc07331..f0ed686bf7f 100644 --- a/detection-rules/impersonation_turbotax.yml +++ b/detection-rules/impersonation_turbotax.yml @@ -14,7 +14,12 @@ source: | ) and sender.email.domain.root_domain not in~ ('intuit.com', 'turbotax.com', 'intuit.ca') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "90084031-cd65-5184-a7d6-a1e61d32b82b" diff --git a/detection-rules/impersonation_twitter.yml b/detection-rules/impersonation_twitter.yml index 3f09aba4177..dc64485fd8c 100644 --- a/detection-rules/impersonation_twitter.yml +++ b/detection-rules/impersonation_twitter.yml @@ -14,7 +14,12 @@ source: | ) and sender.email.domain.domain not in~ ('twitter.com', 'privaterelay.appleid.com', 'stripe.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "013c32c2-fa05-5456-9c45-284e008ff6a4" diff --git a/detection-rules/impersonation_ukr_net.yml b/detection-rules/impersonation_ukr_net.yml index 096d107a387..7a399e522f3 100644 --- a/detection-rules/impersonation_ukr_net.yml +++ b/detection-rules/impersonation_ukr_net.yml @@ -48,7 +48,12 @@ source: | ) ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Sender analysis" + - "Threat intelligence" id: "3cb4015f-1e35-5bba-8d83-d5ed3dfff011" diff --git a/detection-rules/impersonation_ups.yml b/detection-rules/impersonation_ups.yml index dce289a4568..f1c421ae669 100644 --- a/detection-rules/impersonation_ups.yml +++ b/detection-rules/impersonation_ups.yml @@ -18,6 +18,13 @@ source: | ) and any(ml.logo_detect(beta.message_screenshot()).brands, .name is not null) and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Sender analysis" id: "73b68869-5720-5dc3-b4bc-15730de972d8" diff --git a/detection-rules/impersonation_vanta.yml b/detection-rules/impersonation_vanta.yml index 9a407aae9d0..241749c7896 100644 --- a/detection-rules/impersonation_vanta.yml +++ b/detection-rules/impersonation_vanta.yml @@ -19,7 +19,12 @@ source: | ) and sender.email.domain.root_domain in $free_email_providers and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "883d4382-11a6-5924-9e3e-2cb5a11c3f56" diff --git a/detection-rules/impersonation_venmo.yml b/detection-rules/impersonation_venmo.yml index 01230c1196a..d7f223835cb 100644 --- a/detection-rules/impersonation_venmo.yml +++ b/detection-rules/impersonation_venmo.yml @@ -14,7 +14,12 @@ source: | ) and sender.email.domain.root_domain not in~ ('venmo.com', 'synchronybank.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "0ab15d4f-865f-518c-b54d-81043399e6f2" diff --git a/detection-rules/impersonation_vip_urgent_request.yml b/detection-rules/impersonation_vip_urgent_request.yml index 399e7d7de36..ca351239169 100644 --- a/detection-rules/impersonation_vip_urgent_request.yml +++ b/detection-rules/impersonation_vip_urgent_request.yml @@ -1,8 +1,8 @@ name: "VIP impersonation with urgent request (first-time sender)" description: | - Sender is using a display name that matches the display name of someone in your $org_vips list. + Sender is using a display name that matches the display name of someone in your $org_vips list. - Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body first-time senders. + Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body first-time senders. type: "rule" severity: "high" source: | @@ -31,10 +31,14 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "VIP impersonation" - - "Executive impersonation" - - "Suspicious sender" - - "Machine Learning" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Impersonation: VIP" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Content analysis" - "Natural Language Understanding" + - "Sender analysis" id: "0dd1fa60-6e89-5f70-81a1-6b64eef0e428" diff --git a/detection-rules/impersonation_wells_fargo.yml b/detection-rules/impersonation_wells_fargo.yml index fa263090b22..df4a0d019c4 100644 --- a/detection-rules/impersonation_wells_fargo.yml +++ b/detection-rules/impersonation_wells_fargo.yml @@ -18,7 +18,13 @@ source: | ) and sender.email.domain.root_domain not in~ ('wellsfargo.com', 'wellsfargoadvisors.com', 'transunion.com', 'wellsfargoemail.com', 'wellsfargorewards.com', 'comcast-spectacor.com', 'investordelivery.com', 'comcastspectacor.com') and sender.email.email not in $recipient_emails -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Sender analysis" id: "02d7301f-cc29-5031-9a1e-f013400805ba" diff --git a/detection-rules/impersonation_zoom_strict.yml b/detection-rules/impersonation_zoom_strict.yml index d1ed6c9eb42..7f16a2066ac 100644 --- a/detection-rules/impersonation_zoom_strict.yml +++ b/detection-rules/impersonation_zoom_strict.yml @@ -28,7 +28,11 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "00f3d94f-7ed2-5dde-a48d-fb5fcbc20cd2" diff --git a/detection-rules/inline_image_as_message.yml b/detection-rules/inline_image_as_message.yml index fbefd1f6e79..545207dd3ff 100644 --- a/detection-rules/inline_image_as_message.yml +++ b/detection-rules/inline_image_as_message.yml @@ -24,7 +24,13 @@ source: | ) and strings.ilike(body.html.raw, "*img*cid*") and sender.email.email not in $recipient_emails -tags: - - "Malware" - - "Credential phishing" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Image as content" +detection_methods: + - "Content analysis" + - "HTML analysis" + - "URL analysis" id: "823d7107-2605-5671-9acb-ba172d071671" diff --git a/detection-rules/link_coinbase_low_rep_or_shortened.yml b/detection-rules/link_coinbase_low_rep_or_shortened.yml index 256d80b16ce..25ca7d8847f 100644 --- a/detection-rules/link_coinbase_low_rep_or_shortened.yml +++ b/detection-rules/link_coinbase_low_rep_or_shortened.yml @@ -6,13 +6,13 @@ severity: "medium" source: | type.inbound and sender.email.domain.root_domain != "coinbase.com" - + // more than 0 less than 5 links and 0 < length(body.links) < 5 - + // none of the links are to coinbase.com and all(body.links, .href_url.domain.root_domain != "coinbase.com") - + // low rep or url shortened links found and any(body.links, .href_url.domain.domain in $url_shorteners @@ -45,8 +45,16 @@ source: | or any(ml.logo_detect(beta.message_screenshot()).brands, .name == "Coinbase") ) -tags: - - "Brand impersonation" - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Free subdomain host" + - "Image as content" + - "Impersonation: Brand" +detection_methods: - "Computer Vision" + - "Content analysis" + - "File analysis" + - "URL analysis" id: "b61e2f8e-ab8e-5212-ab20-c294babfc6d9" diff --git a/detection-rules/link_contains_punycode_characters.yml b/detection-rules/link_contains_punycode_characters.yml index 3c2000757cc..b6602634cf6 100644 --- a/detection-rules/link_contains_punycode_characters.yml +++ b/detection-rules/link_contains_punycode_characters.yml @@ -25,6 +25,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious content" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Lookalike domain" + - "Punycode" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "74b3698c-d75e-52db-9596-48af93817822" diff --git a/detection-rules/link_credential_phishing.yml b/detection-rules/link_credential_phishing.yml index 1bf25aeaf72..4da5dafcea0 100644 --- a/detection-rules/link_credential_phishing.yml +++ b/detection-rules/link_credential_phishing.yml @@ -20,8 +20,13 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Credential phishing" - - "Suspicious link" - - "Machine Learning" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Sender analysis" + - "URL analysis" + - "URL screenshot" id: "a278012b-6c2b-5bca-b32c-f3663459bb1d" diff --git a/detection-rules/link_credential_phishing_intent_and_other_indicators.yml b/detection-rules/link_credential_phishing_intent_and_other_indicators.yml index 1e857150b43..f2ab0717bac 100644 --- a/detection-rules/link_credential_phishing_intent_and_other_indicators.yml +++ b/detection-rules/link_credential_phishing_intent_and_other_indicators.yml @@ -313,8 +313,15 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Credential phishing" - - "Machine Learning" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free email provider" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" + - "Sender analysis" + - "URL analysis" id: "c2bc8ca2-d207-5c7d-96e4-a0d3d33b2af5" diff --git a/detection-rules/link_credential_phishing_language_ipfs.yml b/detection-rules/link_credential_phishing_language_ipfs.yml index b1a39819299..b94fc53e673 100644 --- a/detection-rules/link_credential_phishing_language_ipfs.yml +++ b/detection-rules/link_credential_phishing_language_ipfs.yml @@ -25,8 +25,14 @@ source: | ) ) ) -tags: +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free file host" + - "Free subdomain host" + - "IPFS" +detection_methods: + - "Content analysis" - "Natural Language Understanding" - - "Credential phishing" - - "Suspicious link" + - "URL analysis" id: "996c4d83-0a13-53e4-928c-6c08caeedab7" diff --git a/detection-rules/link_credential_phishing_secure_message.yml b/detection-rules/link_credential_phishing_secure_message.yml index b9a8687d81c..51ae6b43e60 100644 --- a/detection-rules/link_credential_phishing_secure_message.yml +++ b/detection-rules/link_credential_phishing_secure_message.yml @@ -32,7 +32,11 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: - "Natural Language Understanding" - - "Credential phishing" + - "Sender analysis" id: "bd95a7b1-dc96-53c1-bb7c-3a0f98b04744" diff --git a/detection-rules/link_credential_phishing_suspicious_sender_tld_and_signals.yml b/detection-rules/link_credential_phishing_suspicious_sender_tld_and_signals.yml index 1d5f0d36eaf..b3fbdb5bcb6 100644 --- a/detection-rules/link_credential_phishing_suspicious_sender_tld_and_signals.yml +++ b/detection-rules/link_credential_phishing_suspicious_sender_tld_and_signals.yml @@ -61,8 +61,14 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Credential phishing" - - "Machine Learning" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "File analysis" - "Natural Language Understanding" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" id: "447386dc-e748-5aca-8da4-a3d15345550c" diff --git a/detection-rules/link_credential_phishing_voicemail_language.yml b/detection-rules/link_credential_phishing_voicemail_language.yml index 6298286013f..7b446d465d4 100644 --- a/detection-rules/link_credential_phishing_voicemail_language.yml +++ b/detection-rules/link_credential_phishing_voicemail_language.yml @@ -53,9 +53,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious link" - - "Suspicious content" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Content analysis" - "Natural Language Understanding" - - "Credential phishing" + - "Sender analysis" + - "URL analysis" id: "74ba7787-e543-5ce8-b6eb-e1ecdb8f1d67" diff --git a/detection-rules/link_deactivated_bitly.yml b/detection-rules/link_deactivated_bitly.yml index ad36e9320f4..c7d0fb33248 100644 --- a/detection-rules/link_deactivated_bitly.yml +++ b/detection-rules/link_deactivated_bitly.yml @@ -15,6 +15,10 @@ source: | beta.linkanalysis(.).final_dom.display_text, "*link*blocked*" ) ) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "URL analysis" id: "1528eb6c-22fa-5879-b48c-53ee466fde23" diff --git a/detection-rules/link_download_disk_image_in_encrypted_zip.yml b/detection-rules/link_download_disk_image_in_encrypted_zip.yml index 1045312f38f..03c55ce08db 100644 --- a/detection-rules/link_download_disk_image_in_encrypted_zip.yml +++ b/detection-rules/link_download_disk_image_in_encrypted_zip.yml @@ -1,41 +1,50 @@ -name: "Link to auto-downloaded disk image in encrypted zip" -description: | - A link in the body of the email downloads an encrypted zip that contains a disk image of the format IMG, ISO or VHD. This is a combination of file types used to deliver Qakbot. -type: "rule" -references: - - "https://twitter.com/pr0xylife/status/1592502966409654272" - - "https://delivr.to/payloads?id=ca00292e-d5a2-43f9-b638-6c0b01b73353" - - "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html" - - "https://www.cyfirma.com/outofband/html-smuggling-a-stealthier-approach-to-deliver-malware/" -severity: "medium" -authors: - - twitter: "ajpc500" -source: | - type.inbound - and any(body.links, - any(beta.linkanalysis(.).files_downloaded, - any( - file.explode(.), ( - any(.flavors.yara, . == "encrypted_zip") and - any(.scan.zip.all_paths, any([".img", ".iso", ".vhd"], strings.ends_with(.., .))) - ) - ) - ) - ) - // first-time sender - and ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $sender_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $sender_domains - ) - ) -tags: - - "QakBot" - - "Suspicious link" - - "Malware" - - "HTML smuggling" -id: "b50f0cb1-67b8-570c-9b34-0de08ff52508" +name: "Link to auto-downloaded disk image in encrypted zip" +description: | + A link in the body of the email downloads an encrypted zip that contains a disk image of the format IMG, ISO or VHD. This is a combination of file types used to deliver Qakbot. +type: "rule" +references: + - "https://twitter.com/pr0xylife/status/1592502966409654272" + - "https://delivr.to/payloads?id=ca00292e-d5a2-43f9-b638-6c0b01b73353" + - "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html" + - "https://www.cyfirma.com/outofband/html-smuggling-a-stealthier-approach-to-deliver-malware/" +severity: "medium" +authors: + - twitter: "ajpc500" +source: | + type.inbound + and any(body.links, + any(beta.linkanalysis(.).files_downloaded, + any( + file.explode(.), ( + any(.flavors.yara, . == "encrypted_zip") and + any(.scan.zip.all_paths, any([".img", ".iso", ".vhd"], strings.ends_with(.., .))) + ) + ) + ) + ) + // first-time sender + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) + ) +tags: + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Encryption" + - "Evasion" + - "Social engineering" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Sender analysis" + - "URL analysis" + - "YARA" +id: "b50f0cb1-67b8-570c-9b34-0de08ff52508" diff --git a/detection-rules/link_download_suspicious_file.yml b/detection-rules/link_download_suspicious_file.yml index d0324c36adb..51f23a46dad 100644 --- a/detection-rules/link_download_suspicious_file.yml +++ b/detection-rules/link_download_suspicious_file.yml @@ -45,9 +45,17 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) - -tags: - - "HTML smuggling" - - "Suspicious link" - - "Malware" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Encryption" + - "Evasion" + - "LNK" + - "Social engineering" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Sender analysis" + - "URL analysis" + - "YARA" id: "67ae2152-ac52-52d4-bec2-6bbc4a488df9" diff --git a/detection-rules/link_dynamics_form.yml b/detection-rules/link_dynamics_form.yml index 249601c8526..57279577c92 100644 --- a/detection-rules/link_dynamics_form.yml +++ b/detection-rules/link_dynamics_form.yml @@ -37,7 +37,15 @@ source: | ) ) ) -tags: - - "Suspicious links" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Content analysis" + - "File analysis" + - "Optical Character Recognition" - "Natural Language Understanding" + - "URL analysis" + - "URL screenshot" id: "f72b9085-8c48-5c8c-9b0d-0ce6ef3494dc" diff --git a/detection-rules/link_fake_thread_nlu_financial_request.yml b/detection-rules/link_fake_thread_nlu_financial_request.yml index 25bbfac199f..4f52fb5e712 100644 --- a/detection-rules/link_fake_thread_nlu_financial_request.yml +++ b/detection-rules/link_fake_thread_nlu_financial_request.yml @@ -4,7 +4,7 @@ type: "rule" severity: "medium" source: | type.inbound - + // suspicious link and any(body.links, .href_url.domain.root_domain not in $tranco_1m and @@ -65,9 +65,14 @@ source: | // sender domain matches no body domains all(body.links, .href_url.domain.root_domain != sender.email.domain.root_domain), ) -tags: - - "Suspicious link" - - "Fake Message Thread" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" - - "Machine Learning" + - "Sender analysis" + - "URL analysis" id: "8fd0e211-285d-5cbd-9c11-868c0501b526" diff --git a/detection-rules/link_firebase_new_domain_redirect.yml b/detection-rules/link_firebase_new_domain_redirect.yml index f41911bd9c1..56770e6e0dd 100644 --- a/detection-rules/link_firebase_new_domain_redirect.yml +++ b/detection-rules/link_firebase_new_domain_redirect.yml @@ -13,6 +13,12 @@ source: | strings.icontains(.href_url.domain.domain, "app") and any(beta.linkanalysis(.).redirect_history, beta.whois(.domain).days_old < 7) ) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "URL analysis" + - "Whois" id: "5a204a37-3120-53c1-a55a-5f4f09c61dc4" diff --git a/detection-rules/link_google_amp_suspicious_indicators.yml b/detection-rules/link_google_amp_suspicious_indicators.yml index a0a361cfaf2..69b2c6eb4ea 100644 --- a/detection-rules/link_google_amp_suspicious_indicators.yml +++ b/detection-rules/link_google_amp_suspicious_indicators.yml @@ -9,12 +9,12 @@ type: "rule" severity: "medium" source: | type.inbound - + // Any body links with a domain SLD of 'google' and a path starting with /amp/s and any(body.links, .href_url.domain.sld == "google" and strings.starts_with(.href_url.path, "/amp/s/") - + // Brand Logo detected that is not google and ( any(ml.logo_detect(beta.message_screenshot()).brands, @@ -50,7 +50,18 @@ source: | or any(recipients.to, strings.icontains(..href_url.path, .email.email)) ) ) -tags: +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Impersonation: Brand" - "Open redirect" - - "Credential phishing" +detection_methods: + - "Computer Vision" + - "Content analysis" + - "Natural Language Understanding" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" + - "URL screenshot" id: "46907029-ef83-50a8-9198-75af39dd5f3b" diff --git a/detection-rules/link_google_apps_script_macro.yml b/detection-rules/link_google_apps_script_macro.yml index 027c84db8ee..455c236c8c7 100644 --- a/detection-rules/link_google_apps_script_macro.yml +++ b/detection-rules/link_google_apps_script_macro.yml @@ -22,7 +22,13 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" + - "Social engineering" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "d10146df-547f-5a89-8690-477283e3b1f7" diff --git a/detection-rules/link_google_comment_script_macro.yml b/detection-rules/link_google_comment_script_macro.yml index 04205c4c9d9..f3b769a83de 100644 --- a/detection-rules/link_google_comment_script_macro.yml +++ b/detection-rules/link_google_comment_script_macro.yml @@ -22,7 +22,13 @@ source: | // Or the Sender Display Name is not in your Org Display Names or not any($org_display_names, strings.istarts_with(sender.display_name, strings.concat(., " (Google "))) ) -tags: - - "Suspicious link" - - "Open redirect" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Content analysis" + - "Sender analysis" + - "URL analysis" id: "66fecd30-4628-5e53-b3cb-5355a6741487" diff --git a/detection-rules/link_google_translate.yml b/detection-rules/link_google_translate.yml index 953f843b108..de404ccf609 100644 --- a/detection-rules/link_google_translate.yml +++ b/detection-rules/link_google_translate.yml @@ -1,5 +1,4 @@ name: "Link: Google Translate (unsolicited)" - description: | Attackers have used the Google Translate service to deliver links to malicious sites repackaged with a translate.goog top-level domain. This rule identifies instances of Google Translate links from unsolicited senders. @@ -25,6 +24,12 @@ source: | ) ) tags: - - "Suspicious link" - "Attack surface reduction" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "6949e115-b806-56ea-8976-420bb9d47e5c" diff --git a/detection-rules/link_html_smuggling_with_adobe_branding.yml b/detection-rules/link_html_smuggling_with_adobe_branding.yml index b54b99f3b44..d400afe4923 100644 --- a/detection-rules/link_html_smuggling_with_adobe_branding.yml +++ b/detection-rules/link_html_smuggling_with_adobe_branding.yml @@ -36,9 +36,16 @@ source: | ) ) tags: - - "HTML smuggling" - - "Suspicious link" - - "Brand impersonation" - - "Malware" - - "QakBot" + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "File analysis" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" + - "URL screenshot" id: "e826c2cf-740c-5588-b0a1-8f45bb5baf47" diff --git a/detection-rules/link_html_smuggling_with_google_drive_branding.yml b/detection-rules/link_html_smuggling_with_google_drive_branding.yml index 61aeab77c77..9998b9f2052 100644 --- a/detection-rules/link_html_smuggling_with_google_drive_branding.yml +++ b/detection-rules/link_html_smuggling_with_google_drive_branding.yml @@ -21,7 +21,7 @@ source: | // Hi from Qakbot any(file.explode(beta.linkanalysis(.).screenshot), - all([ + any([ "the file is not displayed correctly", "use local downloaded file" ], strings.icontains(..scan.ocr.raw, .)) @@ -39,9 +39,16 @@ source: | ) ) tags: - - "HTML smuggling" - - "Suspicious link" - - "Brand impersonation" - - "Malware" - - "QakBot" + - "Malfam: QakBot" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "File analysis" + - "Optical Character Recognition" + - "URL analysis" + - "URL screenshot" id: "4b5343be-9b10-58a3-8d14-a1bae1eebc62" diff --git a/detection-rules/link_invoice_fake_customer_service_freemail_sender.yml b/detection-rules/link_invoice_fake_customer_service_freemail_sender.yml index 036bae54467..7e41ca94b07 100644 --- a/detection-rules/link_invoice_fake_customer_service_freemail_sender.yml +++ b/detection-rules/link_invoice_fake_customer_service_freemail_sender.yml @@ -15,8 +15,15 @@ source: | ) // First time sender exclusions are in place to avoid legitimate messages from known freemail senders. and sender.email.email not in $sender_emails -tags: - - "Invoice fraud" - - "Receipt fraud" - - "Customer service fraud" +attack_types: + - "BEC/Fraud" + - "Callback Phishing" +tactics_and_techniques: + - "Free email provider" + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Sender analysis" + - "URL analysis" id: "3825232d-be75-5ad1-ba7f-a3ec97d23960" diff --git a/detection-rules/link_ipfs_phishing.yml b/detection-rules/link_ipfs_phishing.yml index d7d80e9a50c..668f3492769 100644 --- a/detection-rules/link_ipfs_phishing.yml +++ b/detection-rules/link_ipfs_phishing.yml @@ -1,6 +1,5 @@ name: "Link: IPFS" -description: "Detects messages containing links that have 'ipfs' in the domain, or unanalyzed links - that contain 'ipfs' in the url. IPFS has been recently observed hosting phishing sites." +description: "Detects messages containing links that have 'ipfs' in the domain, or unanalyzed links that contain 'ipfs' in the url. IPFS has been recently observed hosting phishing sites." references: - "https://securelist.com/ipfs-phishing/109158/" - "https://docs.ipfs.tech/how-to/address-ipfs-on-web/" @@ -12,7 +11,7 @@ source: | and any(body.links, // Any body link domains contain "ipfs" strings.icontains(.href_url.domain.domain, "ipfs") - + // Or the path contains ipfs anchored to a leading or trailing '-', '/', '.' or ( regex.icontains(.href_url.query_params, '[\.-/]ipfs|ipfs[\.-/]') @@ -45,6 +44,14 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Free file host" + - "Free subdomain host" + - "IPFS" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "19fa6442-83b9-5479-ba04-61906b595929" diff --git a/detection-rules/link_login_or_captcha.yml b/detection-rules/link_login_or_captcha.yml index 897f8b83d8a..a3c163a7d4b 100644 --- a/detection-rules/link_login_or_captcha.yml +++ b/detection-rules/link_login_or_captcha.yml @@ -25,7 +25,7 @@ source: | and .href_url.domain.root_domain not in ("zendesk.com") and beta.linkanalysis(.).effective_url.domain.root_domain not in ("zendesk.com") ) - + // exclude FP prone senders and sender.email.domain.root_domain not in ("sharepointonline.com") @@ -40,8 +40,14 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Credential phishing" - - "Suspicious link" - - "Machine Learning" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free subdomain host" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "File analysis" + - "Sender analysis" + - "URL screenshot" id: "93288f82-fbd2-5e88-b207-7f06386495a6" diff --git a/detection-rules/link_microsoft_device_code_phish.yml b/detection-rules/link_microsoft_device_code_phish.yml index ec098762b03..50111ea8102 100644 --- a/detection-rules/link_microsoft_device_code_phish.yml +++ b/detection-rules/link_microsoft_device_code_phish.yml @@ -41,6 +41,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Sender analysis" + - "URL analysis" id: "61f3ae67-c05c-506f-bbfe-764108a40974" diff --git a/detection-rules/link_microsoft_go2_open_redirect_phish.yml b/detection-rules/link_microsoft_go2_open_redirect_phish.yml index cc550409a62..82d692fcfb2 100644 --- a/detection-rules/link_microsoft_go2_open_redirect_phish.yml +++ b/detection-rules/link_microsoft_go2_open_redirect_phish.yml @@ -22,8 +22,13 @@ source: | and headers.mailer is null and regex.icontains(body.html.inner_text, '(i͏c͏r͏os͏of͏|icrosof)|(office|o)\s?365') -tags: - - "Suspicious link" - - "Credential phishing" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" - "Open redirect" +detection_methods: + - "Content analysis" + - "Header analysis" + - "URL analysis" id: "51667096-1628-5113-809b-97155a03eadf" diff --git a/detection-rules/link_microsoft_impersonation_using_hosted_png.yml b/detection-rules/link_microsoft_impersonation_using_hosted_png.yml index 24677dcc45e..56a8df0da3f 100644 --- a/detection-rules/link_microsoft_impersonation_using_hosted_png.yml +++ b/detection-rules/link_microsoft_impersonation_using_hosted_png.yml @@ -27,7 +27,7 @@ source: | // org domain in the subject of the message and any($org_domains, strings.icontains(subject.subject, .)) - + // first-time sender and ( ( @@ -39,8 +39,14 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Brand impersonation" - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" - "Natural Language Understanding" + - "Sender analysis" + - "URL analysis" id: "07c696d4-c58e-5252-96e2-70211f9de338" diff --git a/detection-rules/link_microsoft_low_reputation.yml b/detection-rules/link_microsoft_low_reputation.yml index c1116fa52dc..f70d7b1a1a5 100644 --- a/detection-rules/link_microsoft_low_reputation.yml +++ b/detection-rules/link_microsoft_low_reputation.yml @@ -91,9 +91,20 @@ source: | "sharepointonline.com", "yammer.com" ) - -tags: - - "Suspicious link" - - "Brand impersonation" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free file host" + - "Image as content" + - "Impersonation: Brand" + - "Social engineering" +detection_methods: - "Computer Vision" + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Natural Language Understanding" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" id: "b59201b6-f253-55a6-9c0a-e1500a32a751" diff --git a/detection-rules/link_new_domain_in_link_first_time_sender.yml b/detection-rules/link_new_domain_in_link_first_time_sender.yml index e88a1d838de..ea1ed146a45 100644 --- a/detection-rules/link_new_domain_in_link_first_time_sender.yml +++ b/detection-rules/link_new_domain_in_link_first_time_sender.yml @@ -18,7 +18,12 @@ source: | ) ) tags: - - "Suspicious link" - - "New domain" - "Attack surface reduction" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +detection_methods: + - "Sender analysis" + - "URL analysis" + - "Whois" id: "4805b0e6-6d35-512b-8053-87dd0edacc8a" diff --git a/detection-rules/link_notion_file_share.yml b/detection-rules/link_notion_file_share.yml index fa67e9cde57..c77e215dfca 100644 --- a/detection-rules/link_notion_file_share.yml +++ b/detection-rules/link_notion_file_share.yml @@ -24,7 +24,14 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) - -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Free file host" +detection_methods: + - "Content analysis" + - "Sender analysis" + - "URL analysis" id: "f7307929-bbfd-58b6-81e4-afff7610cff2" diff --git a/detection-rules/link_office365_suspicious_app_authorization.yml b/detection-rules/link_office365_suspicious_app_authorization.yml index 4df7bdfe762..8a6eceb0163 100644 --- a/detection-rules/link_office365_suspicious_app_authorization.yml +++ b/detection-rules/link_office365_suspicious_app_authorization.yml @@ -11,6 +11,8 @@ source: | type.inbound and any(body.links, .href_url.domain.domain == 'login.microsoftonline.com' and strings.ilike(.href_url.query_params, '*offline_access*', '*.readwrite*', '*.read*')) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" +detection_methods: + - "URL analysis" id: "13a8c430-3e62-5c8f-86b5-3722599bead4" diff --git a/detection-rules/link_outlook_left_to_right_exploit.yml b/detection-rules/link_outlook_left_to_right_exploit.yml index c30f9dcc678..5de1c572dc0 100644 --- a/detection-rules/link_outlook_left_to_right_exploit.yml +++ b/detection-rules/link_outlook_left_to_right_exploit.yml @@ -9,7 +9,13 @@ source: | type.inbound // this regex contains a Unicode U+200E character (may not be visible in many clients) and regex.contains(body.html.raw, 'base.{0,100}‎/>') -tags: - - "Suspicious link" - - "Office exploit" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" + - "Exploit" +detection_methods: + - "Content analysis" + - "HTML analysis" + - "URL analysis" id: "160cc681-dfb3-5820-aa03-37f0289bd0e2" diff --git a/detection-rules/link_qr_code_suspicious_language_fts.yml b/detection-rules/link_qr_code_suspicious_language_fts.yml index 8bb13ac67b0..286d56d4be6 100644 --- a/detection-rules/link_qr_code_suspicious_language_fts.yml +++ b/detection-rules/link_qr_code_suspicious_language_fts.yml @@ -7,18 +7,18 @@ type: "rule" severity: "medium" source: | type.inbound - + // check image attachments for QR code, will want to add message.screenshot functionality here when it's ready and any(attachments, .file_type in~ ('bmp', 'png', 'jpg', 'jpeg', 'gif') and any(file.explode(.), .scan.qr.type == "url" - + // recipient email address is present in the URL, a common tactic used in credential phishing attacks and the url is not in $org_domains and any(recipients.to, strings.icontains(..scan.qr.data, .email.email)) and .scan.qr.url.domain.root_domain not in $org_domains ) ) - + // NLU has identified cred_theft language with high confidence and ( any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "cred_theft" and .confidence == "high") @@ -34,7 +34,7 @@ source: | ) ) ) - + // first-time sender and ( ( @@ -46,8 +46,17 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -tags: - - "Suspicious Link" - - "Natural Language Understanding" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" - "QR code" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Computer Vision" + - "Natural Language Understanding" + - "QR code analysis" + - "Sender analysis" + - "URL analysis" id: "25a84d1c-9578-53e3-98a7-ca9b43abb28b" diff --git a/detection-rules/link_sharepoint_online_multiple_recipients_from_outside_org.yml b/detection-rules/link_sharepoint_online_multiple_recipients_from_outside_org.yml index dccbc21799c..0b4e11af5c0 100644 --- a/detection-rules/link_sharepoint_online_multiple_recipients_from_outside_org.yml +++ b/detection-rules/link_sharepoint_online_multiple_recipients_from_outside_org.yml @@ -11,9 +11,13 @@ source: | and length(recipients.to) > 40 // You may want to adjust this threshold if 40 is too aggressive and any(recipients.to, .email.domain.domain in $free_email_providers) and sender.display_name not in $org_display_names -tags: - - "Suspicious link" - - "Suspicious content" - - "Suspicious subject" - - "Suspicious sender" +attack_types: + - "Credential Phishing" + - "Spam" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Sender analysis" id: "5579bb4b-a225-57c1-99e1-65c704bad6ad" diff --git a/detection-rules/link_undisclosed_recipients_credphish.yml b/detection-rules/link_undisclosed_recipients_credphish.yml index 249341cbf17..12650b125a5 100644 --- a/detection-rules/link_undisclosed_recipients_credphish.yml +++ b/detection-rules/link_undisclosed_recipients_credphish.yml @@ -20,7 +20,12 @@ source: | ) ) ) -tags: - - "Suspicious headers" - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Computer Vision" + - "Header analysis" + - "URL screenshot" id: "06fc155e-f779-50a7-ad5f-3c3777fbf8f5" diff --git a/detection-rules/lookalike_sender_domain.yml b/detection-rules/lookalike_sender_domain.yml index 72f47d708c6..c36d1af53bf 100644 --- a/detection-rules/lookalike_sender_domain.yml +++ b/detection-rules/lookalike_sender_domain.yml @@ -24,7 +24,13 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: - - "Suspicious sender" +attack_types: + - "BEC/Fraud" + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Lookalike domain" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "67721993-4f5d-575b-970b-3ced67a874fa" diff --git a/detection-rules/malformed_url_prefix.yml b/detection-rules/malformed_url_prefix.yml index cfa7f116571..5e973073a53 100644 --- a/detection-rules/malformed_url_prefix.yml +++ b/detection-rules/malformed_url_prefix.yml @@ -1,12 +1,17 @@ name: Malformed URL prefix description: | Malformed URL prefix is a technique used to evade email security scanners. -references: +references: - "https://threatpost.com/malformed-url-prefix-phishing-attacks-spike-6000/164132/" type: "rule" severity: "high" source: | any(body.links, regex.icontains(.href_url.url, ':/\\')) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "URL analysis" id: "4e659d28-53fa-51ca-888d-a7cab1e4bcad" diff --git a/detection-rules/mass_campaign_recipient_address_new_sender.yml b/detection-rules/mass_campaign_recipient_address_new_sender.yml index d6a88ae41cf..28cfdbd4ca9 100644 --- a/detection-rules/mass_campaign_recipient_address_new_sender.yml +++ b/detection-rules/mass_campaign_recipient_address_new_sender.yml @@ -48,9 +48,12 @@ source: | ) // we could add additional logic here, such as suspicious subject, url shortener, sus link, etc. -tags: - - "Credential phishing" - - "Machine Learning" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Header analysis" - "Natural Language Understanding" - - "Suspicious subject" + - "Sender analysis" id: "599dabf5-6287-5adf-8a8f-70649ccf0f92" diff --git a/detection-rules/open_redirect_atdmt.yml b/detection-rules/open_redirect_atdmt.yml index 53b8854fc87..759e44ed73c 100644 --- a/detection-rules/open_redirect_atdmt.yml +++ b/detection-rules/open_redirect_atdmt.yml @@ -10,6 +10,11 @@ severity: "medium" source: | type.inbound and any(body.links, .href_url.domain.domain == 'ad.atdmt.com' and strings.ilike(.href_url.path, '*/c*')) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "URL analysis" id: "fafbd230-bb09-5306-b652-3060639b8660" diff --git a/detection-rules/open_redirect_avast.yml b/detection-rules/open_redirect_avast.yml index 8157f93be99..dec9e0aa290 100644 --- a/detection-rules/open_redirect_avast.yml +++ b/detection-rules/open_redirect_avast.yml @@ -19,7 +19,12 @@ source: | and sender.email.domain.domain not in $recipient_domains ) ) -tags: +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" - - "Suspicious link" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "5f635658-19be-5112-a47b-f8c9bd271999" diff --git a/detection-rules/open_redirect_bmwusa.yml b/detection-rules/open_redirect_bmwusa.yml index 46a69e09457..0ee00f692e9 100644 --- a/detection-rules/open_redirect_bmwusa.yml +++ b/detection-rules/open_redirect_bmwusa.yml @@ -7,7 +7,12 @@ source: | type.inbound and sender.email.domain.root_domain not in~ ('bmw.com', 'bmwusa.com') and any(body.links, .href_url.domain.domain == 't.msg.bmwusa.com' and .href_url.path =~ '/r/') -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "1bf4e69a-1762-5168-8dc9-c5d3d0d4a181" diff --git a/detection-rules/open_redirect_googleweblight.yml b/detection-rules/open_redirect_googleweblight.yml index a9f3018b254..6efa7b7a8a3 100644 --- a/detection-rules/open_redirect_googleweblight.yml +++ b/detection-rules/open_redirect_googleweblight.yml @@ -11,6 +11,12 @@ source: | .href_url.domain.domain == 'googleweblight.com' and strings.ilike(.href_url.url, '*/i?u=*') ) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "27030ba5-c9dc-5789-bd3e-621626e0a123" diff --git a/detection-rules/open_redirect_hhs.yml b/detection-rules/open_redirect_hhs.yml index 98fee55417c..5556fe70450 100644 --- a/detection-rules/open_redirect_hhs.yml +++ b/detection-rules/open_redirect_hhs.yml @@ -9,6 +9,12 @@ source: | type.inbound and any(body.links, .href_url.domain.domain == 'dcis.hhs.gov' and strings.ilike(.href_url.query_params, '*service*')) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "c2d8cda9-358e-5856-93a7-8e76d1ab1df5" diff --git a/detection-rules/open_redirect_linkedin.yml b/detection-rules/open_redirect_linkedin.yml index b6e1fcfec96..4fe8a1dc5e4 100644 --- a/detection-rules/open_redirect_linkedin.yml +++ b/detection-rules/open_redirect_linkedin.yml @@ -11,8 +11,12 @@ source: | and sender.email.domain.root_domain != "linkedin.com" and any(body.links, .href_url.domain.root_domain == 'linkedin.com' and .href_url.path == '/slink') and any(body.links, strings.ilike(.href_url.query_params, 'code=*')) -tags: +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" - - "Suspicious link" - +detection_methods: + - "Sender analysis" + - "URL analysis" id: "5ad2ffae-fca7-58ff-90bd-8efbd98c0a72" diff --git a/detection-rules/open_redirect_mcgill.yml b/detection-rules/open_redirect_mcgill.yml index 2b2a145b9b9..c11b91eb90e 100644 --- a/detection-rules/open_redirect_mcgill.yml +++ b/detection-rules/open_redirect_mcgill.yml @@ -8,7 +8,12 @@ source: | and any(body.links, .href_url.domain.domain == 'myalumni.mcgill.ca' and .href_url.path =~ '/redirect.aspx') and any(body.links, strings.ilike(.href_url.query_params, '*tokenUrl=*')) and sender.email.domain.root_domain != 'mcgill.ca' -tags: +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" - - "Suspicious link" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "5d006c90-a585-576f-84af-d4f9e4365d39" diff --git a/detection-rules/open_redirect_msn.yml b/detection-rules/open_redirect_msn.yml index 3a907e0f6e7..ecaf61f8506 100644 --- a/detection-rules/open_redirect_msn.yml +++ b/detection-rules/open_redirect_msn.yml @@ -16,7 +16,12 @@ source: | and .href_url.path =~ "/en-gb/lifestyle/rf-best-products-uk/redirect" and strings.icontains(.href_url.query_params, "url") ) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "0e0a691a-3bf9-573a-82dd-96b4ef8f96c5" diff --git a/detection-rules/open_redirect_panera_bread.yml b/detection-rules/open_redirect_panera_bread.yml index be9359e78aa..acf8a71a3ed 100644 --- a/detection-rules/open_redirect_panera_bread.yml +++ b/detection-rules/open_redirect_panera_bread.yml @@ -9,6 +9,12 @@ source: | type.inbound and any(body.links, .href_url.domain.domain == 't.e1.panerabread.com' and .href_url.path =~ '/r/') and sender.email.domain.root_domain != 'panerabread.com' -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "91a726a2-9f14-54bf-8f2c-fe7ed7ee6142" diff --git a/detection-rules/open_redirect_samsung.yml b/detection-rules/open_redirect_samsung.yml index d927e18afdd..2c368baf97b 100644 --- a/detection-rules/open_redirect_samsung.yml +++ b/detection-rules/open_redirect_samsung.yml @@ -10,6 +10,12 @@ source: | type.inbound and any(body.links, .href_url.domain.domain == 't.info.samsungusa.com' and .href_url.path =~ '/r/') and sender.email.domain.root_domain != 'samsungusa.com' -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "164ece9a-26ca-5872-9604-7e948722d627" diff --git a/detection-rules/open_redirect_slack.yml b/detection-rules/open_redirect_slack.yml index 779eddba4cf..f2c7632c34c 100644 --- a/detection-rules/open_redirect_slack.yml +++ b/detection-rules/open_redirect_slack.yml @@ -7,6 +7,12 @@ source: | type.inbound and sender.email.domain.root_domain not in~ ('atlassian.net', 'slack.com', 'soundtrap.com') and any(body.links, .href_url.domain.domain == 'slack-redir.net' and strings.ilike(.href_url.query_params, '*url=*')) -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "1b15f4a3-e7ab-56c1-9ba3-f63788389ebe" diff --git a/detection-rules/open_redirect_snapchat.yml b/detection-rules/open_redirect_snapchat.yml index 22f77a548f3..20f76e0e19d 100644 --- a/detection-rules/open_redirect_snapchat.yml +++ b/detection-rules/open_redirect_snapchat.yml @@ -9,6 +9,12 @@ source: | type.inbound and any(body.links, .href_url.domain.domain == "click.snapchat.com") and sender.email.domain.root_domain != "snapchat.com" -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "6f363e68-ced9-5f0e-8951-4070623cd705" diff --git a/detection-rules/open_redirect_ticketmaster.yml b/detection-rules/open_redirect_ticketmaster.yml index acc098a2241..49c98050f58 100644 --- a/detection-rules/open_redirect_ticketmaster.yml +++ b/detection-rules/open_redirect_ticketmaster.yml @@ -10,7 +10,12 @@ source: | and any(body.links, .href_url.domain.domain == 'links.engage.ticketmaster.com' and .href_url.path =~ '/ctt') and sender.email.domain.root_domain != 'ticketmaster.com' and headers.return_path.domain.root_domain != "ticketmaster.com" -tags: +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" - - "Suspicious link" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "a5b3901f-e57b-5fb9-a3d7-ee2205cc0c5b" diff --git a/detection-rules/open_redirect_vk.yml b/detection-rules/open_redirect_vk.yml index 7bd7c3d2bf5..fec229a9238 100644 --- a/detection-rules/open_redirect_vk.yml +++ b/detection-rules/open_redirect_vk.yml @@ -9,7 +9,12 @@ source: | type.inbound and any(body.links, .href_url.domain.root_domain == 'vk.com' and .href_url.path =~ '/away.php') and sender.email.domain.root_domain != 'vk.com' -tags: +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: - "Open redirect" - - "Suspicious link" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "6ebd6d42-b0d5-5585-a715-aa939097ed99" diff --git a/detection-rules/open_redirect_youtube.yml b/detection-rules/open_redirect_youtube.yml index a09bdd7d568..3edbb9797ee 100644 --- a/detection-rules/open_redirect_youtube.yml +++ b/detection-rules/open_redirect_youtube.yml @@ -9,6 +9,12 @@ source: | type.inbound and any(body.links, .href_url.domain.root_domain == "youtube.com" and strings.icontains(.href_url.url, "attribution_link?")) and sender.email.domain.root_domain != "youtube.com" -tags: - - "Suspicious link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Open redirect" +detection_methods: + - "Sender analysis" + - "URL analysis" id: "fb33bffe-d3db-5acb-ae19-5ddc6b5b0b01" diff --git a/detection-rules/paypal_invoice_abuse.yml b/detection-rules/paypal_invoice_abuse.yml index 4f47dfb2a9a..90549fbc2f0 100644 --- a/detection-rules/paypal_invoice_abuse.yml +++ b/detection-rules/paypal_invoice_abuse.yml @@ -8,39 +8,46 @@ references: - "https://anderegg.ca/2023/02/01/a-novel-paypal-scam" severity: "medium" source: | - type.inbound - and length(attachments) == 0 - and sender.email.domain.root_domain == "paypal.com" - and not any(headers.hops, .authentication_results.dmarc == "fail") - and strings.ilike(body.html.display_text, "*seller note*") - and ( - ( - //phone number but not 800 number - regex.contains(body.html.inner_text, '[\s:,-]\+?\d{1,2}[\s:,-]\(?([2-7][0-9]{2}|80[1-9]|8[1-9][0-9])\)?[\s:,-]\d{3}[\s:,-]\d{4}\b') - and ( - 4 of ( - strings.ilike(body.html.inner_text, '*you did not*'), - strings.ilike(body.html.inner_text, '*subscription*'), - strings.ilike(body.html.inner_text, '*antivirus*'), - strings.ilike(body.html.inner_text, '*order*'), - strings.ilike(body.html.inner_text, '*support*'), - strings.ilike(body.html.inner_text, '*receipt*'), - strings.ilike(body.html.inner_text, '*invoice*'), - strings.ilike(body.html.inner_text, '*call*'), - strings.ilike(body.html.inner_text, '*cancel*'), - strings.ilike(body.html.inner_text, '*renew*'), - strings.ilike(body.html.inner_text, '*refund*'), - strings.ilike(body.html.inner_text, '*+1*'), - strings.ilike(body.html.inner_text, '*help*desk*') - ) - ) - ) - or ( - //Unicode confusables words obfuscated in note - regex.contains(body.html.inner_text, '\+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹') - ) - ) -tags: + type.inbound + and length(attachments) == 0 + and sender.email.domain.root_domain == "paypal.com" + and not any(headers.hops, .authentication_results.dmarc == "fail") + and strings.ilike(body.html.display_text, "*seller note*") + and ( + ( + //phone number but not 800 number + regex.contains(body.html.inner_text, '[\s:,-]\+?\d{1,2}[\s:,-]\(?([2-7][0-9]{2}|80[1-9]|8[1-9][0-9])\)?[\s:,-]\d{3}[\s:,-]\d{4}\b') + and ( + 4 of ( + strings.ilike(body.html.inner_text, '*you did not*'), + strings.ilike(body.html.inner_text, '*subscription*'), + strings.ilike(body.html.inner_text, '*antivirus*'), + strings.ilike(body.html.inner_text, '*order*'), + strings.ilike(body.html.inner_text, '*support*'), + strings.ilike(body.html.inner_text, '*receipt*'), + strings.ilike(body.html.inner_text, '*invoice*'), + strings.ilike(body.html.inner_text, '*call*'), + strings.ilike(body.html.inner_text, '*cancel*'), + strings.ilike(body.html.inner_text, '*renew*'), + strings.ilike(body.html.inner_text, '*refund*'), + strings.ilike(body.html.inner_text, '*+1*'), + strings.ilike(body.html.inner_text, '*help*desk*') + ) + ) + ) + or ( + //Unicode confusables words obfuscated in note + regex.contains(body.html.inner_text, '\+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹') + ) + ) +attack_types: + - "BEC/Fraud" - "Callback Phishing" - - "Customer service fraud" +tactics_and_techniques: + - "Evasion" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Sender analysis" id: "0ff7a0d4-164d-5ff1-8765-783fa2008b0f" diff --git a/detection-rules/punycode_sender_domain.yml b/detection-rules/punycode_sender_domain.yml index bed5f01ddbb..fc010ad69d5 100644 --- a/detection-rules/punycode_sender_domain.yml +++ b/detection-rules/punycode_sender_domain.yml @@ -10,8 +10,14 @@ type: "rule" severity: "high" source: | type.inbound and strings.ilike(sender.email.domain.domain, "*xn--*") -tags: - - "Suspicious sender" - - "Punycode" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" - "Lookalike domain" + - "Punycode" + - "Social engineering" +detection_methods: + - "Sender analysis" id: "bc3d8db5-dc83-5b77-bee4-9cf62f32b6de" diff --git a/detection-rules/recipients_undisclosed_compauth_check.yml b/detection-rules/recipients_undisclosed_compauth_check.yml index 984ec6c09ab..2a6d2c4bbc8 100644 --- a/detection-rules/recipients_undisclosed_compauth_check.yml +++ b/detection-rules/recipients_undisclosed_compauth_check.yml @@ -33,9 +33,11 @@ source: | ) ) ) -tags: - - "Suspicious sender" - - "Suspicious headers" +detection_methods: + - "Content analysis" + - "Computer Vision" + - "Header analysis" - "Natural Language Understanding" - - "Machine Learning" + - "URL analysis" + - "URL screenshot" id: "34fb65f6-03e8-5752-b602-4f294172b5db" diff --git a/detection-rules/recipients_undisclosed_free_subdomain_host.yml b/detection-rules/recipients_undisclosed_free_subdomain_host.yml index 50d2de0c853..192c3709b64 100644 --- a/detection-rules/recipients_undisclosed_free_subdomain_host.yml +++ b/detection-rules/recipients_undisclosed_free_subdomain_host.yml @@ -5,7 +5,7 @@ type: "rule" severity: "medium" source: | type.inbound - + and any(body.links, .href_url.domain.root_domain in $free_subdomain_hosts and .href_url.domain.subdomain is not null @@ -17,7 +17,9 @@ source: | ) and length(recipients.cc) == 0 and length(recipients.bcc) == 0 -tags: - - "Suspicious link" - - "Suspicious headers" +tactics_and_techniques: + - "Free subdomain host" +detection_methods: + - "Header analysis" + - "URL analysis" id: "c23d979d-de80-599d-b0ca-c7fef217885e" diff --git a/detection-rules/recipients_undisclosed_nlu_cred_theft_low_rep_links.yml b/detection-rules/recipients_undisclosed_nlu_cred_theft_low_rep_links.yml index 728f7c5d427..50ab9cacd78 100644 --- a/detection-rules/recipients_undisclosed_nlu_cred_theft_low_rep_links.yml +++ b/detection-rules/recipients_undisclosed_nlu_cred_theft_low_rep_links.yml @@ -1,6 +1,5 @@ name: "Suspicious Recipients pattern with NLU credential theft indicators" -description: "Detects messages with undisclosed recipients (likely all bcc) and NLU identified a - credential theft intent with medium to high confidence from a suspicious low reputation link domain" +description: "Detects messages with undisclosed recipients (likely all bcc) and NLU identified a credential theft intent with medium to high confidence from a suspicious low reputation link domain" type: "rule" severity: "medium" source: | @@ -12,7 +11,7 @@ source: | and length(recipients.cc) == 0 and length(recipients.bcc) == 0 and any(body.links, .href_url.domain.domain not in $tranco_1m) - + and ( any(body.links, regex.icontains(.display_text, '(view|click|download|goto)?(attachment|download|file|online|document)s?') @@ -25,9 +24,13 @@ source: | .name in ("cred_theft") and .confidence in ("medium", "high") ) -tags: - - "Suspicious sender" - - "Suspicious headers" - - "Suspicious link" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Content analysis" + - "Header analysis" - "Natural Language Understanding" + - "URL analysis" id: "8e121c3e-b9cf-5aa3-b799-e025a69b7d8c" diff --git a/detection-rules/sender_new_from_domain_first_time_sender.yml b/detection-rules/sender_new_from_domain_first_time_sender.yml index 23b3e70fc61..61bf772d666 100644 --- a/detection-rules/sender_new_from_domain_first_time_sender.yml +++ b/detection-rules/sender_new_from_domain_first_time_sender.yml @@ -17,7 +17,8 @@ source: | ) ) tags: - - "Suspicious sender" - - "New domain" - "Attack surface reduction" +detection_methods: + - "Sender analysis" + - "Whois" id: "d87fa543-aabb-55f5-9660-23c9e7a85b2a" diff --git a/detection-rules/spam_campaign_excessive_display_text_with_keywords.yml b/detection-rules/spam_campaign_excessive_display_text_with_keywords.yml index 616ee7220d5..ad1dbaa3f82 100644 --- a/detection-rules/spam_campaign_excessive_display_text_with_keywords.yml +++ b/detection-rules/spam_campaign_excessive_display_text_with_keywords.yml @@ -1,15 +1,15 @@ name: "Spam: Campaign with excessive display-text and keywords found" -type: "rule" description: | Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found. -references: - - "https://playground.sublimesecurity.com?id=aa90e106-fa06-43f2-aa85-50d69591e073" +references: + - "https://playground.sublimesecurity.com?id=aa90e106-fa06-43f2-aa85-50d69591e073" +type: "rule" +severity: "low" source: | type.inbound and length(body.links) > 0 - and ( - any(body.links, length(.display_text) >3000) - ) + and any(body.links, length(.display_text) >3000) + and any( body.links, regex.icontains(.display_text, '(\bPassword:)', 'Hi.{0,5}Welcome\b') ) @@ -24,7 +24,8 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -severity: "low" -tags: +attack_types: - "Spam" +detection_methods: + - "Content analysis" id: "140e46a1-c8a6-530a-ad88-21b7e4b4b02f" diff --git a/detection-rules/spam_campaign_excessive_space_obfuscation_free_file_hosting.yml b/detection-rules/spam_campaign_excessive_space_obfuscation_free_file_hosting.yml index 69aa68b9e0f..027e82f540d 100644 --- a/detection-rules/spam_campaign_excessive_space_obfuscation_free_file_hosting.yml +++ b/detection-rules/spam_campaign_excessive_space_obfuscation_free_file_hosting.yml @@ -2,7 +2,7 @@ name: "Spam: Campaign with excessive space/char obfuscation and free file hosted description: | This rule detects mass spam campaigns using excessive space padding with links utilizing free file hosting. -references: +references: - "https://playground.sublimesecurity.com?id=a340c08c-a1d9-41a9-96f8-6d1fe888cb5b" type: "rule" severity: "low" @@ -22,6 +22,11 @@ source: | ) or sender.email.domain.valid == false ) -tags: +attack_types: - "Spam" +tactics_and_techniques: + - "Free file host" +detection_methods: + - "Content analysis" + - "Sender analysis" id: "122bc0ca-4f9c-5403-9b4e-7e9d47b92ef2" diff --git a/detection-rules/spam_url_shortener_emojis.yml b/detection-rules/spam_url_shortener_emojis.yml index dfc0a6c7d1b..9e06b64f841 100644 --- a/detection-rules/spam_url_shortener_emojis.yml +++ b/detection-rules/spam_url_shortener_emojis.yml @@ -1,7 +1,8 @@ name: "Spam: URL shortener with short body content and emojis" -type: "rule" description: | Detects spam from freemail senders, where the majority of the body is a URL shortener and emojis. +type: "rule" +severity: "low" source: | type.inbound @@ -34,7 +35,12 @@ source: | and sender.email.domain.domain not in $sender_domains ) ) -severity: "low" -tags: +attack_types: - "Spam" +tactics_and_techniques: + - "Free email provider" +detection_methods: + - "Content analysis" + - "Sender analysis" + - "URL analysis" id: "b7797e4c-f2d7-5330-8a16-7123fe9bb6a8" diff --git a/detection-rules/spoof_dropbox.yml b/detection-rules/spoof_dropbox.yml index b23ab4c22aa..32e7d3076d6 100644 --- a/detection-rules/spoof_dropbox.yml +++ b/detection-rules/spoof_dropbox.yml @@ -9,7 +9,13 @@ source: | and any(distinct(headers.hops, .authentication_results.dmarc is not null), strings.ilike(.authentication_results.dmarc, "*fail")) // mitigates situations where an ESG misconfiguration could cause auth failures and not strings.ends_with(headers.message_id, ".dropbox.com>") -tags: - - "Brand impersonation" - - "Suspicious sender" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Impersonation: Brand" + - "Spoofing" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "bd99740a-07e1-5c6f-92f6-b223478effa8" diff --git a/detection-rules/spoofable_internal_domain_suspicious_signals.yml b/detection-rules/spoofable_internal_domain_suspicious_signals.yml index 9446d76c936..d9c07b3caf2 100644 --- a/detection-rules/spoofable_internal_domain_suspicious_signals.yml +++ b/detection-rules/spoofable_internal_domain_suspicious_signals.yml @@ -73,5 +73,17 @@ source: | ) tags: - - "Spoof" + - "Attack surface reduction" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Free file host" + - "Free subdomain host" + - "Social engineering" + - "Spoofing" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Natural Language Understanding" + - "Sender analysis" id: "40089d69-9150-5270-97f1-9f68e4ca9a5a" diff --git a/detection-rules/stripe_invoice_abuse.yml b/detection-rules/stripe_invoice_abuse.yml index ed10ac1a16d..673d28d72b2 100644 --- a/detection-rules/stripe_invoice_abuse.yml +++ b/detection-rules/stripe_invoice_abuse.yml @@ -10,7 +10,7 @@ source: | and length(attachments) == 2 and sender.email.domain.root_domain == "stripe.com" and any(headers.hops, .authentication_results.dmarc == "pass") - + and any(attachments, .file_extension == "pdf" and any(file.explode(.), length(filter(.scan.strings.strings, strings.ilike(., @@ -23,7 +23,12 @@ source: | ))) >= 4 ) ) -tags: +attack_types: + - "BEC/Fraud" - "Callback Phishing" - - "Customer service fraud" +tactics_and_techniques: + - "PDF" +detection_methods: + - "File analysis" + - "Header analysis" id: "90162d16-0311-579f-b256-b501ca29bb35" diff --git a/detection-rules/suspicious_request_for_quote_html_smuggling.yml.yml b/detection-rules/suspicious_request_for_quote_html_smuggling.yml similarity index 92% rename from detection-rules/suspicious_request_for_quote_html_smuggling.yml.yml rename to detection-rules/suspicious_request_for_quote_html_smuggling.yml index d2542148923..616f8ce02c5 100644 --- a/detection-rules/suspicious_request_for_quote_html_smuggling.yml.yml +++ b/detection-rules/suspicious_request_for_quote_html_smuggling.yml @@ -6,7 +6,7 @@ type: "rule" severity: "high" source: | type.inbound - + // RFP/RFQ language and 1 of ( ( @@ -36,7 +36,7 @@ source: | body.html.display_text, body.plain.raw)).tags,.name == "purchase_order" and .confidence == "high") ) ) - + // HTML smuggling and any(attachments, ( @@ -61,10 +61,15 @@ source: | ) ) ) -tags: - - "RFP" - - "RFQ" - - "Suspicious attachment" - - "HTML smuggling" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Content analysis" + - "File analysis" + - "HTML analysis" + - "Javascript analysis" - "Natural Language Understanding" + - "URL analysis" id: "a47a5755-a698-5daf-98b5-21cdcf893ee2" diff --git a/detection-rules/suspicious_request_for_quote_or_purchase.yml b/detection-rules/suspicious_request_for_quote_or_purchase.yml index a2cf639cba3..32845806c39 100644 --- a/detection-rules/suspicious_request_for_quote_or_purchase.yml +++ b/detection-rules/suspicious_request_for_quote_or_purchase.yml @@ -21,7 +21,7 @@ source: | and any(headers.reply_to, .email.email not in $recipient_emails) ) ) - + and 2 of ( ( regex.icontains(coalesce(body.html.display_text, body.plain.raw), '(discuss.{0,15}purchas(e|ing))') @@ -50,10 +50,13 @@ source: | body.html.display_text, body.plain.raw)).tags,.name == "purchase_order" and .confidence == "high") ) ) -tags: - - "Suspicious sender" - - "Fraud" - - "RFQ" - - "RFP" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Evasion" + - "Free email provider" +detection_methods: + - "Content analysis" - "Natural Language Understanding" + - "URL analysis" id: "2ac0d329-c1fb-5c87-98dd-ea3e5b85377a" diff --git a/detection-rules/suspicious_sharepoint_file_share_undisclosed_recipients.yml b/detection-rules/suspicious_sharepoint_file_share_undisclosed_recipients.yml index 35d02c72e37..c150bd7e286 100644 --- a/detection-rules/suspicious_sharepoint_file_share_undisclosed_recipients.yml +++ b/detection-rules/suspicious_sharepoint_file_share_undisclosed_recipients.yml @@ -6,13 +6,19 @@ type: "rule" severity: "medium" source: | type.inbound - + // Suspicious recipient pattern and any(recipients.to, .display_name == "Undisclosed recipients") and strings.contains(body.html.display_text, "shared a file with you") and strings.icontains(subject.subject, "shared") and any(body.links, .href_url.domain.root_domain == "sharepoint.com") -tags: - - "Suspicious headers" - - "Suspicious Link" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Content analysis" + - "Header analysis" + - "URL analysis" id: "998a0826-e917-5a8f-9e15-0f1ded21bf91" diff --git a/detection-rules/suspicious_shipping_notification.yml b/detection-rules/suspicious_shipping_notification.yml index 7791cb14d75..3d1f34b6141 100644 --- a/detection-rules/suspicious_shipping_notification.yml +++ b/detection-rules/suspicious_shipping_notification.yml @@ -7,20 +7,25 @@ source: | type.inbound // contains at least 1 link and length(body.links) > 0 - + and 3 of ( strings.ilike(coalesce(body.html.display_text, body.plain.raw), "*(1)*"), strings.ilike(coalesce(body.html.display_text, body.plain.raw), "*waiting for delivery*"), strings.ilike(coalesce(body.html.display_text, body.plain.raw), "*delivery missed*"), strings.ilike(coalesce(body.html.display_text, body.plain.raw), "*tracking number*") ) - + // urgent/time-sensitive language and any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "urgency") - + // email is not personalized with recipients name and any(recipients.to, any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .text == ..email.local_part)) -tags: +attack_types: + - "Credential Phishing" + - "Spam" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Content analysis" - "Natural Language Understanding" - - "Suspicious body" id: "67748b0a-ac4c-525c-8393-7ed7b1b51f29" diff --git a/detection-rules/uri_handler_search_ms.yml b/detection-rules/uri_handler_search_ms.yml index 6c9b796840c..3743df9390d 100644 --- a/detection-rules/uri_handler_search_ms.yml +++ b/detection-rules/uri_handler_search_ms.yml @@ -17,7 +17,11 @@ source: | ) ) ) -tags: - - "Suspicious attachment" - - "Malware" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "File analysis" + - "HTML analysis" id: "ee27d9c0-2d7e-5f6d-85be-73f3bf5b7cb1" diff --git a/detection-rules/urlhaus_malicious_dom_in_body_or_pdf.yml b/detection-rules/urlhaus_malicious_dom_in_body_or_pdf.yml index 99588db10e5..f5f22f7b46a 100644 --- a/detection-rules/urlhaus_malicious_dom_in_body_or_pdf.yml +++ b/detection-rules/urlhaus_malicious_dom_in_body_or_pdf.yml @@ -45,8 +45,14 @@ source: | ) ) tags: - - "Suspicious links" - - "Suspicious attachments" - - "URLhaus" - - "Abusech" + - "Abusech: URLhaus" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "PDF" +detection_methods: + - "File analysis" + - "Threat intelligence" + - "URL analysis" id: "cfca2986-0daa-582c-a379-fb0a31329847" diff --git a/detection-rules/vip_impersonation_attack_surface_reduction.yml b/detection-rules/vip_impersonation_attack_surface_reduction.yml index 56290b850b9..7b1babdc6ee 100644 --- a/detection-rules/vip_impersonation_attack_surface_reduction.yml +++ b/detection-rules/vip_impersonation_attack_surface_reduction.yml @@ -1,52 +1,57 @@ name: "VIP / Executive impersonation (first-time sender, unsolicited)" description: | - Sender display name matches the display name of a user in the $org_vips list, and the sender has never been seen before. + Sender display name matches the display name of a user in the $org_vips list, and the sender has never been seen before. - The $org_vips list must first be manually connected to a VIP group of your upstream provider (Google Workspace and Microsoft 365 only) in order for this rule to work. - Once connected, the list will be automatically synced and kept up-to-date. For more information, see the $org_vips documentation: https://docs.sublimesecurity.com/docs/configure-org_vips-list + The $org_vips list must first be manually connected to a VIP group of your upstream provider (Google Workspace and Microsoft 365 only) in order for this rule to work. + Once connected, the list will be automatically synced and kept up-to-date. For more information, see the $org_vips documentation: https://docs.sublimesecurity.com/docs/configure-org_vips-list - This rule is recommended to be used on a relatively small list of VIPs, and is meant to reduce attack surface by detecting *any* message that matches the protected list of display names from a first-time or unsolicited sender. + This rule is recommended to be used on a relatively small list of VIPs, and is meant to reduce attack surface by detecting *any* message that matches the protected list of display names from a first-time or unsolicited sender. - Additional rule logic can be added to look for suspicious subjects, suspicious links, etc. + Additional rule logic can be added to look for suspicious subjects, suspicious links, etc. type: "rule" severity: "high" -source: | - type.inbound +source: | + type.inbound - and any($org_vips, .display_name == sender.display_name) + and any($org_vips, .display_name == sender.display_name) - and ( - // ignore personal <> work emails - // where the sender and mailbox's display name are the same - length(recipients.to) > 1 or length(recipients.cc) > 1 - or sender.display_name != mailbox.display_name - ) + and ( + // ignore personal <> work emails + // where the sender and mailbox's display name are the same + length(recipients.to) > 1 or length(recipients.cc) > 1 + or sender.display_name != mailbox.display_name + ) - // first-time sender - and ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $sender_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $sender_domains - ) - ) + // first-time sender + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) + ) - // unsolicited - and ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $recipient_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $recipient_domains - ) - ) + // unsolicited + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $recipient_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $recipient_domains + ) + ) tags: - - "VIP impersonation" - - "Executive impersonation" - "Attack surface reduction" +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Impersonation: VIP" +detection_methods: + - "Header analysis" + - "Sender analysis" id: "e42c84b7-9d50-5870-9a5d-311670a14bc1" From 4fa2e63ceeaafb459fa86a08dc4852cb408ac9ca Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Wed, 9 Aug 2023 10:53:22 -0700 Subject: [PATCH 17/40] Adding login.squarespace.com to negations (#651) --- detection-rules/link_login_or_captcha.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/link_login_or_captcha.yml b/detection-rules/link_login_or_captcha.yml index a3c163a7d4b..28342feeed5 100644 --- a/detection-rules/link_login_or_captcha.yml +++ b/detection-rules/link_login_or_captcha.yml @@ -24,6 +24,7 @@ source: | // if it's a known brand impersonation, we'll detect it in other rules and .href_url.domain.root_domain not in ("zendesk.com") and beta.linkanalysis(.).effective_url.domain.root_domain not in ("zendesk.com") + and beta.linkanalysis(.).effective_url.domain.domain not in ("login.squarespace.com") ) // exclude FP prone senders From 4e866223c3fe8a7f4b1f110ac30a5e20226e22aa Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Wed, 9 Aug 2023 10:54:43 -0700 Subject: [PATCH 18/40] Adding Microsoft.com to FP check (#650) Co-authored-by: Sam Scholten --- detection-rules/link_microsoft_low_reputation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detection-rules/link_microsoft_low_reputation.yml b/detection-rules/link_microsoft_low_reputation.yml index f70d7b1a1a5..8c1f579ea3e 100644 --- a/detection-rules/link_microsoft_low_reputation.yml +++ b/detection-rules/link_microsoft_low_reputation.yml @@ -21,7 +21,7 @@ source: | ) // exclude sources of potential FPs - and .href_url.domain.root_domain not in ("svc.ms", "sharepoint.com", "1drv.ms") + and .href_url.domain.root_domain not in ("svc.ms", "sharepoint.com", "1drv.ms", "microsoft.com") ) // not a reply From 911f8df08ef700ae619af6d5c377aeab1aa847bd Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Thu, 10 Aug 2023 09:24:37 -0700 Subject: [PATCH 19/40] Add retries to posting the completed "check" & Other Fixes (#654) --- .github/workflows/clear-old-test-rules.yml | 2 +- .github/workflows/rule-validate.yml | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/clear-old-test-rules.yml b/.github/workflows/clear-old-test-rules.yml index c5f6d3429a2..f0cefca1ccb 100644 --- a/.github/workflows/clear-old-test-rules.yml +++ b/.github/workflows/clear-old-test-rules.yml @@ -63,7 +63,7 @@ jobs: if [[ "$in_open_pr" = "false" ]]; then rm $file - echo "Removed $pr_num" >> ../message.txt + echo "Removed $file_pr_num" >> ../message.txt fi done diff --git a/.github/workflows/rule-validate.yml b/.github/workflows/rule-validate.yml index a5b0a727660..1a574a79339 100644 --- a/.github/workflows/rule-validate.yml +++ b/.github/workflows/rule-validate.yml @@ -8,7 +8,9 @@ on: workflow_dispatch: {} concurrency: - group: ${{ github.head_ref }} + # For pull_request_target workflows we want to use head_ref -- the branch triggering the workflow. Otherwise, + # use ref, which is the branch for a push event. + group: ${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }} cancel-in-progress: true jobs: @@ -97,6 +99,11 @@ jobs: - name: "Create a check run" uses: actions/github-script@v6 if: github.event_name == 'pull_request_target' + retries: 3 + # Default includes 422 which GitHub returns when it doesn't know about the head_sha we set the status for. + # This occurs when the previous push succeeds, but the checks/pull request component of GitHub isn't yet aware + # of the new commit. This isn't the common case, but it comes up enough to be annoying. + retry-exempt-status-codes: 400, 401, 403, 404 env: parameter_url: '${{ github.event.pull_request.html_url }}' with: From 01f02a042d040a1f52809c7e405272c9af578ff5 Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Thu, 10 Aug 2023 10:59:54 -0700 Subject: [PATCH 20/40] Move retry configuration (#656) --- .github/workflows/rule-validate.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/rule-validate.yml b/.github/workflows/rule-validate.yml index 1a574a79339..78efe60f6dc 100644 --- a/.github/workflows/rule-validate.yml +++ b/.github/workflows/rule-validate.yml @@ -99,15 +99,15 @@ jobs: - name: "Create a check run" uses: actions/github-script@v6 if: github.event_name == 'pull_request_target' - retries: 3 - # Default includes 422 which GitHub returns when it doesn't know about the head_sha we set the status for. - # This occurs when the previous push succeeds, but the checks/pull request component of GitHub isn't yet aware - # of the new commit. This isn't the common case, but it comes up enough to be annoying. - retry-exempt-status-codes: 400, 401, 403, 404 env: parameter_url: '${{ github.event.pull_request.html_url }}' with: debug: ${{ secrets.ACTIONS_STEP_DEBUG || false }} + retries: 3 + # Default includes 422 which GitHub returns when it doesn't know about the head_sha we set the status for. + # This occurs when the previous push succeeds, but the checks/pull request component of GitHub isn't yet aware + # of the new commit. This isn't the common case, but it comes up enough to be annoying. + retry-exempt-status-codes: 400, 401, 403, 404 script: | // any JavaScript code can go here, you can use Node JS APIs too. // Docs: https://docs.github.com/en/rest/checks/runs#create-a-check-run From 261277e4015431b4738e4fa0a4fc3baa20b8d27d Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Thu, 10 Aug 2023 16:52:13 -0400 Subject: [PATCH 21/40] Adding Malware/Ransomware to applicable HTML attachment rules (#652) --- detection-rules/attachment_eml_with_html_attachment.yml | 1 + detection-rules/attachment_html_excessive_padding.yml | 1 + detection-rules/attachment_html_smuggling_atob.yml | 1 + .../attachment_html_smuggling_auto_file_download.yml | 1 + .../attachment_html_smuggling_concatenation_obfuscation.yml | 1 + detection-rules/attachment_html_smuggling_embedded_b64_iso.yml | 2 +- detection-rules/attachment_html_smuggling_eval_atob.yml | 2 +- .../attachment_html_smuggling_fromcharcode_and_others.yml | 2 +- detection-rules/attachment_html_smuggling_hex_strings.yml | 1 + detection-rules/attachment_html_smuggling_location.yml | 2 +- detection-rules/attachment_html_smuggling_raw_buffer.yml | 1 + detection-rules/attachment_html_smuggling_rc4.yml | 1 + detection-rules/attachment_html_smuggling_unescape.yml | 2 +- 13 files changed, 13 insertions(+), 5 deletions(-) diff --git a/detection-rules/attachment_eml_with_html_attachment.yml b/detection-rules/attachment_eml_with_html_attachment.yml index 68cc2a3bb4b..221f4a1e697 100644 --- a/detection-rules/attachment_eml_with_html_attachment.yml +++ b/detection-rules/attachment_eml_with_html_attachment.yml @@ -57,6 +57,7 @@ tags: - "Attack surface reduction" attack_types: - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" diff --git a/detection-rules/attachment_html_excessive_padding.yml b/detection-rules/attachment_html_excessive_padding.yml index b1578f1631f..c77855d95b5 100644 --- a/detection-rules/attachment_html_excessive_padding.yml +++ b/detection-rules/attachment_html_excessive_padding.yml @@ -17,6 +17,7 @@ source: | ) attack_types: - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" diff --git a/detection-rules/attachment_html_smuggling_atob.yml b/detection-rules/attachment_html_smuggling_atob.yml index f8d82676247..22a231df0c6 100644 --- a/detection-rules/attachment_html_smuggling_atob.yml +++ b/detection-rules/attachment_html_smuggling_atob.yml @@ -33,6 +33,7 @@ source: | ) attack_types: - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "HTML smuggling" - "Scripting" diff --git a/detection-rules/attachment_html_smuggling_auto_file_download.yml b/detection-rules/attachment_html_smuggling_auto_file_download.yml index cc4a3be885d..23a25411362 100644 --- a/detection-rules/attachment_html_smuggling_auto_file_download.yml +++ b/detection-rules/attachment_html_smuggling_auto_file_download.yml @@ -34,6 +34,7 @@ source: | ) attack_types: - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "HTML smuggling" - "Scripting" diff --git a/detection-rules/attachment_html_smuggling_concatenation_obfuscation.yml b/detection-rules/attachment_html_smuggling_concatenation_obfuscation.yml index 22e072d099b..03ef8b93fba 100644 --- a/detection-rules/attachment_html_smuggling_concatenation_obfuscation.yml +++ b/detection-rules/attachment_html_smuggling_concatenation_obfuscation.yml @@ -22,6 +22,7 @@ source: | ) attack_types: - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" diff --git a/detection-rules/attachment_html_smuggling_embedded_b64_iso.yml b/detection-rules/attachment_html_smuggling_embedded_b64_iso.yml index 1bb259c77ca..43ee40b7a9e 100644 --- a/detection-rules/attachment_html_smuggling_embedded_b64_iso.yml +++ b/detection-rules/attachment_html_smuggling_embedded_b64_iso.yml @@ -26,8 +26,8 @@ source: | )) ) attack_types: - - "Malware/Ransomware" - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" diff --git a/detection-rules/attachment_html_smuggling_eval_atob.yml b/detection-rules/attachment_html_smuggling_eval_atob.yml index 99e9f955e75..7a3e89c662a 100644 --- a/detection-rules/attachment_html_smuggling_eval_atob.yml +++ b/detection-rules/attachment_html_smuggling_eval_atob.yml @@ -17,8 +17,8 @@ source: | ) ) attack_types: - - "Malware/Ransomware" - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" diff --git a/detection-rules/attachment_html_smuggling_fromcharcode_and_others.yml b/detection-rules/attachment_html_smuggling_fromcharcode_and_others.yml index 94d1114a0a5..6ea62440e16 100644 --- a/detection-rules/attachment_html_smuggling_fromcharcode_and_others.yml +++ b/detection-rules/attachment_html_smuggling_fromcharcode_and_others.yml @@ -24,8 +24,8 @@ source: | ) ) attack_types: - - "Malware/Ransomware" - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" diff --git a/detection-rules/attachment_html_smuggling_hex_strings.yml b/detection-rules/attachment_html_smuggling_hex_strings.yml index 32ec45b662f..25e6610ab9f 100644 --- a/detection-rules/attachment_html_smuggling_hex_strings.yml +++ b/detection-rules/attachment_html_smuggling_hex_strings.yml @@ -25,6 +25,7 @@ source: | ) attack_types: - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" diff --git a/detection-rules/attachment_html_smuggling_location.yml b/detection-rules/attachment_html_smuggling_location.yml index a12cc6adccb..f18a6b260b6 100644 --- a/detection-rules/attachment_html_smuggling_location.yml +++ b/detection-rules/attachment_html_smuggling_location.yml @@ -20,8 +20,8 @@ source: | ) ) attack_types: - - "Malware/Ransomware" - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" diff --git a/detection-rules/attachment_html_smuggling_raw_buffer.yml b/detection-rules/attachment_html_smuggling_raw_buffer.yml index 8f7c837bfdf..7962e6fa060 100644 --- a/detection-rules/attachment_html_smuggling_raw_buffer.yml +++ b/detection-rules/attachment_html_smuggling_raw_buffer.yml @@ -26,6 +26,7 @@ source: | ) attack_types: - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "Free subdomain host" diff --git a/detection-rules/attachment_html_smuggling_rc4.yml b/detection-rules/attachment_html_smuggling_rc4.yml index 6a14559da2a..5172cd98bc7 100644 --- a/detection-rules/attachment_html_smuggling_rc4.yml +++ b/detection-rules/attachment_html_smuggling_rc4.yml @@ -20,6 +20,7 @@ source: | ) attack_types: - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Encryption" - "Evasion" diff --git a/detection-rules/attachment_html_smuggling_unescape.yml b/detection-rules/attachment_html_smuggling_unescape.yml index de8e19bdfc4..c422585275e 100644 --- a/detection-rules/attachment_html_smuggling_unescape.yml +++ b/detection-rules/attachment_html_smuggling_unescape.yml @@ -17,8 +17,8 @@ source: | any(.scan.javascript.identifiers, . == "unescape")) ) attack_types: - - "Malware/Ransomware" - "Credential Phishing" + - "Malware/Ransomware" tactics_and_techniques: - "Evasion" - "HTML smuggling" From 207319de6ab0a1e2cbbdfaa6c37b7171f8934550 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Thu, 10 Aug 2023 16:57:55 -0700 Subject: [PATCH 22/40] New Rule (Attachment): .csproj with suspicious commands (#645) Co-authored-by: ID Generator Co-authored-by: Sam Scholten --- .../attachment_suspicious_csproj.yml | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 detection-rules/attachment_suspicious_csproj.yml diff --git a/detection-rules/attachment_suspicious_csproj.yml b/detection-rules/attachment_suspicious_csproj.yml new file mode 100644 index 00000000000..06c22e23675 --- /dev/null +++ b/detection-rules/attachment_suspicious_csproj.yml @@ -0,0 +1,28 @@ +name: "Attachment: .csproj with suspicious commands" +description: | + Attached .csproj file contains suspicious commands. +references: + - "https://delivr.to/payloads?id=9d80cf8d-fb68-40fb-8969-4b11f3a29c9f" +type: "rule" +severity: "high" +source: | + type.inbound + and any(attachments, + .file_extension == "csproj" + and any(file.explode(.), + ( + (any(.scan.strings.strings, strings.contains(., 'DllImport'))) + and (any(.scan.strings.strings, strings.icontains(., 'CreateProcess'))) + ) + ) + ) +tags: + - "Suspicious attachment" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Scripting" +detection_methods: + - "File analysis" +id: "fe45b81d-43df-52fc-9bf8-79824819fb51" From c8b687d7b62170fdfa373c627a4cb1321d0bb55b Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 14 Aug 2023 13:54:47 -0700 Subject: [PATCH 23/40] New Rule (Attachment): HTML file contains exclusively Javascript (#586) Co-authored-by: Cameron Dunn Co-authored-by: ID Generator Co-authored-by: Sam Scholten --- .../attachment_html_all_script.yml | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 detection-rules/attachment_html_all_script.yml diff --git a/detection-rules/attachment_html_all_script.yml b/detection-rules/attachment_html_all_script.yml new file mode 100644 index 00000000000..f6c6ff606a7 --- /dev/null +++ b/detection-rules/attachment_html_all_script.yml @@ -0,0 +1,34 @@ +name: "Attachment: HTML file contains exclusively Javascript" +description: | + Attached HTML file does not contain any HTML other than a ") + ) + ) + ) +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" +id: "b6d38168-20bb-5550-8843-6af9426af8b1" From 886910bf0cc7f3a3d8f016c03c67f4878e9d55e5 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 14 Aug 2023 13:59:47 -0700 Subject: [PATCH 24/40] New Rule: Wise impersonation with suspicious attachment (#458) Co-authored-by: Sam Scholten Co-authored-by: Cameron Dunn Co-authored-by: ID Generator Co-authored-by: Sam Scholten --- ...personation_wise_suspicious_attachment.yml | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 detection-rules/impersonation_wise_suspicious_attachment.yml diff --git a/detection-rules/impersonation_wise_suspicious_attachment.yml b/detection-rules/impersonation_wise_suspicious_attachment.yml new file mode 100644 index 00000000000..b9dc0a5af75 --- /dev/null +++ b/detection-rules/impersonation_wise_suspicious_attachment.yml @@ -0,0 +1,29 @@ +name: "Brand impersonation: Wise with suspicious attachment" +description: | + Impersonating Wise Financial, as confirmed by NLU, and contains a suspicious attachment type. +type: "rule" +severity: "high" +source: | + type.inbound + and ( + strings.ilike(sender.display_name, '*wise*') + or strings.ilike(sender.email.domain.domain, '*wise*') + ) + and any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name in ("payment", "invoice")) + and any(attachments, .file_type + in~ $file_extensions_common_archives + or .file_type in~ $file_extensions_executables + or .file_type in~ $file_extensions_macros + or .file_type in ("lz") + ) + and sender.email.domain.root_domain not in~ ('wise.com', 'wise.jobs') +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "Natural Language Understanding" + - "Sender analysis" +id: "01480f95-dc1e-5b9a-a360-96bfee663c39" From cc4bcf6f1c3524496d5bdabdc4453eaebcaa095c Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 14 Aug 2023 14:11:53 -0700 Subject: [PATCH 25/40] Update impersonation_wise_suspicious_attachment.yml (#662) --- .../impersonation_wise_suspicious_attachment.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detection-rules/impersonation_wise_suspicious_attachment.yml b/detection-rules/impersonation_wise_suspicious_attachment.yml index b9dc0a5af75..7ee9bb9b194 100644 --- a/detection-rules/impersonation_wise_suspicious_attachment.yml +++ b/detection-rules/impersonation_wise_suspicious_attachment.yml @@ -9,11 +9,11 @@ source: | strings.ilike(sender.display_name, '*wise*') or strings.ilike(sender.email.domain.domain, '*wise*') ) - and any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name in ("payment", "invoice")) + and any(ml.nlu_classifier(body.current_thread.text).tags, .name in ("payment", "invoice")) and any(attachments, .file_type - in~ $file_extensions_common_archives - or .file_type in~ $file_extensions_executables - or .file_type in~ $file_extensions_macros + in $file_extensions_common_archives + or .file_type in $file_extensions_executables + or .file_type in $file_extensions_macros or .file_type in ("lz") ) and sender.email.domain.root_domain not in~ ('wise.com', 'wise.jobs') From d755b6e5f1569f6e4741ffea568a9d7d65025b33 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 14 Aug 2023 14:16:58 -0700 Subject: [PATCH 26/40] New Rule (Attachment): PowerPoint with suspicious hyperlink (#384) Co-authored-by: Cameron Dunn Co-authored-by: ID Generator Co-authored-by: Sam Scholten Co-authored-by: Sam Scholten --- .../attachment_powerpoint_hyperlinks.yml | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 detection-rules/attachment_powerpoint_hyperlinks.yml diff --git a/detection-rules/attachment_powerpoint_hyperlinks.yml b/detection-rules/attachment_powerpoint_hyperlinks.yml new file mode 100644 index 00000000000..ffe826ae20a --- /dev/null +++ b/detection-rules/attachment_powerpoint_hyperlinks.yml @@ -0,0 +1,34 @@ +name: "Attachment: PowerPoint with suspicious hyperlink" +description: | + Attached PowerPoint contains a suspicious hyperlink that can execute arbitrary code. +references: + - "https://twitter.com/doc_guard/status/1570190610774257665" +type: "rule" +severity: "high" +source: | + type.inbound + and any(attachments, (.file_extension in~ ("ppt", "pptx")) + and any(file.explode(.), + any(.scan.exiftool.fields, .key == "Hyperlinks" + and ( + 4 of ( + strings.ilike(.value, "*[Convert]::ToChar*"), + strings.ilike(.value, "*vbs*"), + strings.ilike(.value, "*[IO.File]::Create*"), + strings.ilike(.value, "*[IO.File]::Exists*"), + strings.ilike(.value, "*[io.FileOPtions]::DeleteOnClose*"), + strings.ilike(.value, "*Net.WebClient*"), + strings.ilike(.value, "*dll*"), + ) + ) + ) + )) +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "Scripting" +detection_methods: + - "Exif analysis" + - "File analysis" +id: "0a999fb1-f44f-54cf-814b-6fd2e83f5704" From d0e841df3786e4a7d827e94540d656db493bac87 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 14 Aug 2023 15:07:54 -0700 Subject: [PATCH 27/40] Updating Rule: adding length check to mitigate FPs (#584) Co-authored-by: Cameron Dunn Co-authored-by: Sam Scholten --- .../impersonation_recipient_sld_in_sender_local_fts.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml b/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml index 55bf067c41c..087cf4725c7 100644 --- a/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml +++ b/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml @@ -6,7 +6,13 @@ description: | the sender's domain is not a known org domain, and it's a first time sender. source: | type.inbound - and any(recipients.to, strings.contains(sender.email.local_part, .email.domain.sld)) + and ( + any(recipients.to, + (strings.contains(sender.email.local_part, .email.domain.sld) + // checking to ensure no FPs, like "me" in "me.com" + and length(.email.domain.sld) > 3) + ) + ) and sender.email.domain.root_domain not in $org_domains and ( ( From 293500d6c53329d6f45051273f052194a83f3665 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 14 Aug 2023 15:28:57 -0700 Subject: [PATCH 28/40] Adding PDF scanning to LinkedIn open redirect rule (#604) Co-authored-by: Sam Scholten --- detection-rules/open_redirect_linkedin.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/detection-rules/open_redirect_linkedin.yml b/detection-rules/open_redirect_linkedin.yml index 4fe8a1dc5e4..d5e063483f3 100644 --- a/detection-rules/open_redirect_linkedin.yml +++ b/detection-rules/open_redirect_linkedin.yml @@ -8,9 +8,19 @@ authors: severity: "medium" source: | type.inbound - and sender.email.domain.root_domain != "linkedin.com" - and any(body.links, .href_url.domain.root_domain == 'linkedin.com' and .href_url.path == '/slink') - and any(body.links, strings.ilike(.href_url.query_params, 'code=*')) + and ( + ( + sender.email.domain.root_domain != "linkedin.com" + and any(body.links, .href_url.domain.root_domain == 'linkedin.com' and .href_url.path == '/slink') + and any(body.links, strings.ilike(.href_url.query_params, 'code=*')) + ) + or any(attachments, .file_type == "pdf" + and any(file.explode(.), + any(.scan.url.urls, .domain.root_domain == 'linkedin.com' and .path == '/slink') + and any(.scan.url.urls, strings.ilike(.query_params, 'code=*')) + ) + ) + ) attack_types: - "Credential Phishing" - "Malware/Ransomware" @@ -19,4 +29,4 @@ tactics_and_techniques: detection_methods: - "Sender analysis" - "URL analysis" -id: "5ad2ffae-fca7-58ff-90bd-8efbd98c0a72" +id: "5ad2ffae-fca7-58ff-90bd-8efbd98c0a72" \ No newline at end of file From daa3f162f4561af7c78f8741b4b4997961144178 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 14 Aug 2023 15:33:03 -0700 Subject: [PATCH 29/40] Updating Rule: Reformatting & changing to inner_text (#634) Co-authored-by: ID Generator Co-authored-by: Cameron Dunn Co-authored-by: Sam Scholten Co-authored-by: Sam Scholten --- ...lback_phishing_nlu_body_or_attachments.yml | 43 +++++++++---------- 1 file changed, 21 insertions(+), 22 deletions(-) diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml index afda7fa2094..4aa91a9de3c 100644 --- a/detection-rules/callback_phishing_nlu_body_or_attachments.yml +++ b/detection-rules/callback_phishing_nlu_body_or_attachments.yml @@ -4,31 +4,30 @@ description: | type: "rule" severity: "medium" source: | - type.inbound - and ( - any(attachments, .file_type in ("png", "jpg", "pdf") - and any(file.explode(.), - any(ml.nlu_classifier(.scan.ocr.raw).intents, - .name == "callback_scam" and .confidence == "high" - ) + type.inbound + and ( + any(attachments, + .file_type in ("png", "jpg", "pdf") + and any(file.explode(.), + any(ml.nlu_classifier(.scan.ocr.raw).intents, + .name == "callback_scam" and .confidence == "high" + ) + ) + ) + or any(ml.nlu_classifier(body.current_thread.text).intents, + .name in ("callback_scam") and .confidence == "high" ) ) - or - any(ml.nlu_classifier(coalesce( - body.html.display_text, body.plain.raw)).intents, - .name in ("callback_scam") and .confidence == "high" - ) - ) - and ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $sender_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $sender_domains + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) ) - ) attack_types: - "Callback Phishing" tactics_and_techniques: From 92a72201babd8347735585953686ca843fea3989 Mon Sep 17 00:00:00 2001 From: Aiden Mitchell <30846409+aidenmitchell@users.noreply.github.com> Date: Mon, 14 Aug 2023 15:35:18 -0700 Subject: [PATCH 30/40] Updating Rule: Fixing FP (#632) Co-authored-by: ID Generator Co-authored-by: Cameron Dunn Co-authored-by: Sam Scholten --- detection-rules/impersonation_chase.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/impersonation_chase.yml b/detection-rules/impersonation_chase.yml index 192655c7548..3c1732303ac 100644 --- a/detection-rules/impersonation_chase.yml +++ b/detection-rules/impersonation_chase.yml @@ -16,6 +16,7 @@ source: | or strings.ilevenshtein(sender.display_name, 'united mileageplus') <= 2 or strings.ilevenshtein(sender.display_name, 'echase') <= 2 ) + and sender.display_name not in ("Chaser") and sender.email.domain.root_domain not in~ ('chase.com', 'united.com', 'transunion.com') and sender.email.email not in $recipient_emails attack_types: From d25a5d85c614e54d406fe463e59c79a5ff4c7fe0 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Mon, 14 Aug 2023 20:07:49 -0400 Subject: [PATCH 31/40] Rule Tune: eml with html login portal, negate replies (#641) Co-authored-by: Cameron Dunn --- .../attachment_eml_html_attachment_portal.yml | 99 ++++++++++++------- 1 file changed, 62 insertions(+), 37 deletions(-) diff --git a/detection-rules/attachment_eml_html_attachment_portal.yml b/detection-rules/attachment_eml_html_attachment_portal.yml index 98d3889b126..5dc69446d86 100644 --- a/detection-rules/attachment_eml_html_attachment_portal.yml +++ b/detection-rules/attachment_eml_html_attachment_portal.yml @@ -5,59 +5,84 @@ type: "rule" severity: "high" source: | type.inbound + // exclude bounce backs & read receipts and not strings.like(sender.email.local_part, "*postmaster*", "*mailer-daemon*", "*administrator*") and not regex.icontains(subject.subject, "^(undeliverable|read:)") and not any(attachments, .content_type == "message/delivery-status") + // if the "References" is in the body of the message, it's probably a bounce - and not any(headers.references, - strings.contains(body.html.display_text, .) + and not any(headers.references, strings.contains(body.html.display_text, .)) + and ( + (length(headers.references) == 0 and headers.in_reply_to is null) + or ( + not strings.istarts_with(subject.subject, "re:") + and not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To"))) + and not any(headers.hops, strings.ilike(.signature.headers, "*:reply-to")) + ) ) - and any(attachments, .content_type == "message/rfc822" - and any(file.explode(.), - ( - // suspicious strings found in javascript - length(filter(.scan.javascript.strings, strings.ilike(., - "*username*", "*login-form*", "*email-form*", "*Incorrect password. Please try again.*", "*Password Incomplete, please try again*" - ))) >= 3 or - ( - // suspicious strings found outside of javascript, but binexplode'd file still of HTML type - .flavors.mime in~ ("text/html", "text/plain") and - length(filter(.scan.strings.strings, strings.ilike(., - "*username*", "*login-form*", "*email-form*", "*Incorrect password. Please try again.*", "*Password Incomplete, please try again*" - ))) >= 3 - ) - ) or - //Known phishing obfuscation - ( - length( - filter( - .scan.strings.strings, strings.ilike(., - //Enter password - "*Enter password*", - //Forgotten my password - "*Forgotten my password*", - //Sign in - "*Sign in*" + and any(attachments, + .content_type == "message/rfc822" + and any(file.explode(.), + ( + // suspicious strings found in javascript + length(filter(.scan.javascript.strings, + strings.ilike(., + "*username*", + "*login-form*", + "*email-form*", + "*Incorrect password. Please try again.*", + "*Password Incomplete, please try again*" + ) + ) ) - ) - ) >= 2 - ) - ) + >= 3 + or ( + + // suspicious strings found outside of javascript, but binexplode'd file still of HTML type + .flavors.mime in~ ("text/html", "text/plain") + and length(filter(.scan.strings.strings, + strings.ilike(., + "*username*", + "*login-form*", + "*email-form*", + "*Incorrect password. Please try again.*", + "*Password Incomplete, please try again*" + ) + ) + ) + >= 3 + ) + ) + or + + //Known phishing obfuscation + ( + length(filter(.scan.strings.strings, + strings.ilike(., + //Enter password + "*Enter password*", + //Forgotten my password + "*Forgotten my password*", + //Sign in + "*Sign in*" + ) + ) + ) + >= 2 + ) + ) ) attack_types: - "Credential Phishing" tactics_and_techniques: - "Evasion" - - "Free file host" - - "Free subdomain host" - "HTML smuggling" - - "IPFS" detection_methods: - "Content analysis" - "File analysis" - "Header analysis" - "HTML analysis" - "Javascript analysis" - - "URL analysis" -id: "6e4df158-6498-572b-9448-a343c531e5f9" + - "Sender analysis" +id: "6e4df158-6498-572b-9448-a343c531e5f9" \ No newline at end of file From 0ae8cd5ac29a2ec7184a9bfa26e2aa2fd80f7e95 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Mon, 14 Aug 2023 20:37:30 -0400 Subject: [PATCH 32/40] New Rule: Google impersonation Fake sign-in warning image lure (#598) Co-authored-by: Cameron Dunn Co-authored-by: ID Generator Co-authored-by: Josh Kamdjou --- .../link_google_fake_sign_in_image_lure.yml | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 detection-rules/link_google_fake_sign_in_image_lure.yml diff --git a/detection-rules/link_google_fake_sign_in_image_lure.yml b/detection-rules/link_google_fake_sign_in_image_lure.yml new file mode 100644 index 00000000000..0f7f8a25679 --- /dev/null +++ b/detection-rules/link_google_fake_sign_in_image_lure.yml @@ -0,0 +1,50 @@ +name: "Brand impersonation: Google fake sign-in warning" +description: | + Detects messages with image attachments containing fake Google sign-in warnings with no links leading to Google sites. +type: "rule" +severity: "high" +source: | + type.inbound + and length(body.links) > 0 + + // Google Logo in Attachment + and any(attachments, + .file_type in ('png', 'jpeg', 'jpg', 'bmp') + and any(ml.logo_detect(.).brands, .name in ("Google")) + ) + and any(attachments, + .file_type in~ ('bmp', 'png', 'jpg', 'jpeg') + and ( + any(file.explode(.), + // Fake activity warning + length(filter(.scan.strings.strings, strings.ilike(., + "*new sign-in*", + "*google account*", + "*secure your account*", + "*check activity*" + ))) >= 3 + ) + ) + ) + + // legitimate sign-in warnings contains links to google, gmail or googleapis.com + and ( + not all(body.links, + .href_url.domain.root_domain in ("google.com", "gmail.com", "googleapis.com") + or .href_url.domain.root_domain is null + ) + ) + and sender.email.domain.root_domain not in $org_domains + and sender.email.domain.root_domain != "google.com" +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "File analysis" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" +id: "2d998eee-476b-5f9c-a244-3c11f79138dd" From 8737eb18cce587e9442ed7d8b714af874ca4670d Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Mon, 14 Aug 2023 20:39:50 -0400 Subject: [PATCH 33/40] New Rule: Fake fax with low reputation link (#573) Co-authored-by: Cameron Dunn Co-authored-by: ID Generator Co-authored-by: Josh Kamdjou --- .../link_fake_fax_low_reputation.yml | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 detection-rules/link_fake_fax_low_reputation.yml diff --git a/detection-rules/link_fake_fax_low_reputation.yml b/detection-rules/link_fake_fax_low_reputation.yml new file mode 100644 index 00000000000..0bf72f79c40 --- /dev/null +++ b/detection-rules/link_fake_fax_low_reputation.yml @@ -0,0 +1,82 @@ +name: "Brand impersonation: Fake fax" +description: | + Detects the presence of known brand logos, mentions of "fax" in the subject or sender's display name, and a low reputation link from a first-time sender. +references: + - "https://www.hoxhunt.com/blog/fax-phishing" +type: "rule" +severity: "medium" +source: | + type.inbound + and 0 < length(body.links) < 5 + and sender.email.domain.root_domain not in $org_domains + and any(body.links, + ( + .href_url.domain.domain not in $tranco_1m or + .href_url.domain.domain in $free_file_hosts or + .href_url.domain.root_domain in $free_subdomain_hosts or + .href_url.domain.domain in $url_shorteners or + + // mass mailer link, masks the actual URL + .href_url.domain.root_domain in ( + "hubspotlinks.com", + "mandrillapp.com", + "sendgrid.net", + ) + ) + ) + + // any brand logo detected + and ( + any(attachments, + .file_type in ('png', 'jpeg', 'jpg', 'bmp') + and any(ml.logo_detect(.).brands, .name is not null) + ) + or any(ml.logo_detect(beta.message_screenshot()).brands, + .name is not null) + ) + + // Subject or sender contains fax + and ( + strings.icontains(subject.subject, "fax") or + strings.icontains(sender.display_name, "fax") + ) + + // suspicious content + and ( + strings.ilike(body.plain.raw, "*fax*") + or ( + any(attachments, + .file_type in ('png', 'jpeg', 'jpg', 'bmp') + and any(file.explode(.), + strings.ilike(.scan.ocr.raw, "*fax*") + ) + ) + ) + ) + + // first time sender + and ( + ( + sender.email.domain.root_domain in $free_email_providers + and sender.email.email not in $sender_emails + ) + or ( + sender.email.domain.root_domain not in $free_email_providers + and sender.email.domain.domain not in $sender_domains + ) + ) +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Image as content" + - "Free file host" + - "Free subdomain host" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Content analysis" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" +id: "2a96b90a-64bf-52ad-b4e4-6f1e8c1dcba6" From 48fa78c1781b40445eec032742aa36ed6ba11813 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Mon, 14 Aug 2023 21:03:40 -0400 Subject: [PATCH 34/40] Update link_google_open_redirect.yml to account for the optional language params (#659) --- signals/links/link_google_open_redirect.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/signals/links/link_google_open_redirect.yml b/signals/links/link_google_open_redirect.yml index 2e6a6d2e877..5d5aa0ac8e5 100644 --- a/signals/links/link_google_open_redirect.yml +++ b/signals/links/link_google_open_redirect.yml @@ -2,4 +2,4 @@ name: "Link: Google Open Redirect" type: "query" source: | length(filter(body.links, - regex.icontains(.href_url.url, "https?://(www.)?google.[a-zA-Z]{2,}/url\\?q=https?://.+"))) + regex.icontains(.href_url.url, "https?://(www.)?google.[a-zA-Z]{2,}/url\\?(hl=.{2})?&q=http(s)?://"))) From b37557e0f1e81ab53cbc4ecc4ed3d8f340e2d183 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Mon, 14 Aug 2023 22:13:53 -0400 Subject: [PATCH 35/40] New Insight: Tracking pixel in HTML body (#663) --- insights/content/tracking_pixel.yml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 insights/content/tracking_pixel.yml diff --git a/insights/content/tracking_pixel.yml b/insights/content/tracking_pixel.yml new file mode 100644 index 00000000000..c3634167889 --- /dev/null +++ b/insights/content/tracking_pixel.yml @@ -0,0 +1,7 @@ +name: "Tracking pixel in HTML body" +type: "query" +source: | + regex.contains(body.html.raw, ']*?width="1(px)?"[^>]*?height="1(px)?"[^>]*?style="[^"]*(visibility:hidden|display:none)[^"]*"[^>]*?>') +severity: "low" +tags: + - "Tracking pixel" From e8f01c18d2490695cade9e816b63c44f667a18cc Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Mon, 14 Aug 2023 22:44:27 -0400 Subject: [PATCH 36/40] Adding support for quoted printable variant (#664) --- insights/content/tracking_pixel.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/insights/content/tracking_pixel.yml b/insights/content/tracking_pixel.yml index c3634167889..bf77570e07c 100644 --- a/insights/content/tracking_pixel.yml +++ b/insights/content/tracking_pixel.yml @@ -1,7 +1,16 @@ name: "Tracking pixel in HTML body" type: "query" source: | - regex.contains(body.html.raw, ']*?width="1(px)?"[^>]*?height="1(px)?"[^>]*?style="[^"]*(visibility:hidden|display:none)[^"]*"[^>]*?>') + ( + // standard html + regex.contains(body.html.raw, + ']*?width="1(px)?"[^>]*?height="1(px)?"[^>]*?style="[^"]*(visibility:hidden|display:none)[^"]*"[^>]*?>' + ) + // handle quoted printable variants + or regex.contains(body.html.raw, + '' + ) + ) severity: "low" tags: - "Tracking pixel" From e671b549d720c7eef7c15e9d08f150d6096e38b5 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Mon, 14 Aug 2023 23:00:06 -0400 Subject: [PATCH 37/40] Rule Tune: Negating paypal senders with dmarc pass due to FP reports (#642) --- ...eaders_freemail_replyto_returnpath_mismatch.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/detection-rules/headers_freemail_replyto_returnpath_mismatch.yml b/detection-rules/headers_freemail_replyto_returnpath_mismatch.yml index b1a481f76ad..c0360a0682b 100644 --- a/detection-rules/headers_freemail_replyto_returnpath_mismatch.yml +++ b/detection-rules/headers_freemail_replyto_returnpath_mismatch.yml @@ -4,16 +4,20 @@ type: "rule" severity: "medium" source: | type.inbound - and any(ml.nlu_classifier(coalesce( - body.html.display_text, body.plain.raw)).intents, - .name in ("bec") and .confidence in ("medium", "high") + and any(ml.nlu_classifier(body.current_thread.text).intents, + .name in ("bec") and .confidence in ("medium", "high") ) and ( headers.return_path.domain.root_domain in $free_email_providers or ( length(headers.reply_to) > 0 - and all(headers.reply_to, - .email.domain.root_domain in $free_email_providers) + and all(headers.reply_to, .email.domain.root_domain in $free_email_providers) + ) + ) + and not ( + sender.email.domain.root_domain == "paypal.com" + and any(distinct(headers.hops, .authentication_results.dmarc is not null), + strings.ilike(.authentication_results.dmarc, "*pass") ) ) and sender.email.domain.root_domain not in $free_email_providers From a359ab6b0306b69cde44c2cb0fefd994f8a9e879 Mon Sep 17 00:00:00 2001 From: Josh Kamdjou Date: Mon, 14 Aug 2023 20:06:17 -0700 Subject: [PATCH 38/40] Allow domain for Amazon impersonation (#665) --- detection-rules/impersonation_amazon.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/impersonation_amazon.yml b/detection-rules/impersonation_amazon.yml index 8e15f87b5b3..40e073c96a3 100644 --- a/detection-rules/impersonation_amazon.yml +++ b/detection-rules/impersonation_amazon.yml @@ -40,6 +40,7 @@ source: | 'amazon.com.tr', 'amazonpay.in', 'amazonpay.com', + 'q4inc.com', 'synchronybank.com', ) and sender.email.email not in $recipient_emails From e12e8de84ccafba2f7d264a4710564ec517ab0d4 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Tue, 15 Aug 2023 10:51:30 -0400 Subject: [PATCH 39/40] New Rule: Brand impersonation: Microsoft fake sign-in alert (#661) Co-authored-by: ID Generator Co-authored-by: Josh Kamdjou --- ...rsonation_microsoft_fake_sign_in_alert.yml | 96 +++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100644 detection-rules/impersonation_microsoft_fake_sign_in_alert.yml diff --git a/detection-rules/impersonation_microsoft_fake_sign_in_alert.yml b/detection-rules/impersonation_microsoft_fake_sign_in_alert.yml new file mode 100644 index 00000000000..6b655705cea --- /dev/null +++ b/detection-rules/impersonation_microsoft_fake_sign_in_alert.yml @@ -0,0 +1,96 @@ +name: "Brand impersonation: Microsoft fake sign-in alert" +description: | + Detects messages impersonating Microsoft that mimic sign-in security alerts and attempt to solicit a response. +type: "rule" +severity: "medium" +source: | + type.inbound + // no links found in body + and length(body.links) == 0 + // Microsoft strings + and ( + strings.contains(subject.subject, "Microsoft") + or strings.contains(sender.display_name, "Microsoft") + or strings.contains(body.current_thread.text, "Microsoft") + or ( + + // or Microsoft Brand logo + any(attachments, + .file_type in ('png', 'jpeg', 'jpg', 'bmp') + and any(ml.logo_detect(.).brands, strings.starts_with(.name, "Microsoft")) + ) + ) + ) + + // Body contains Indicators of fake sign in notification + and ( + regex.contains(body.current_thread.text, + '(Country.region:.{0,20}IP address:|Platform:.{0,20}Browser:)' + ) + or regex.contains(body.current_thread.text, "Unusual.{0,10}activity") + ) + + + and ( + + // If the sender is freemail + sender.email.domain.domain in $free_email_providers + or ( + + // sender is not freemail, but the return path email or reply to email is + sender.email.domain.domain not in $free_email_providers + and ( + headers.return_path.domain.root_domain in $free_email_providers + or ( + length(headers.reply_to) > 0 + and ( + all(headers.reply_to, .email.domain.root_domain in $free_email_providers) + ) + ) + or ( + + // if all replyto domain, return_path domain, sender domain mismatch + length(headers.reply_to) > 0 + and all(headers.reply_to, + .email.domain.domain != headers.return_path.domain.domain + and headers.return_path.domain.domain != sender.email.domain.domain + ) + ) + + // or the domain is less than 90 days old + or beta.whois(sender.email.domain).days_old <= 90 + or ( + + // or Compauth verdict is not pass/softpass + any(headers.hops, + .authentication_results.compauth.verdict is not null + and .authentication_results.compauth.verdict not in ("pass", "softpass") + ) + ) + ) + ) + ) + and sender.email.domain.root_domain not in ( + "bing.com", + "microsoft.com", + "microsoftonline.com", + "microsoftsupport.com", + "microsoft365.com", + "office.com", + "onedrive.com", + "sharepointonline.com", + "yammer.com", + ) +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Computer Vision" + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Sender analysis" + - "Whois" +id: "3f4c9e7a-4d85-5bee-bc8c-3a737924c236" From 7228764813f89a63f63e55d474120aecccec3a5b Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Wed, 16 Aug 2023 14:21:10 -0400 Subject: [PATCH 40/40] Adding header/content signals, moving attachment signals to attachments dir (#666) --- signals/{ => attachments}/attachment_count.yml | 0 .../{ => attachments}/attachment_filesizes.yml | 0 signals/content/body_tracking_pixel.yml | 13 +++++++++++++ signals/headers/headers_fake_thread.yml | 9 +++++++++ signals/headers/headers_gmail_autoforward.yml | 7 +++++++ signals/headers/headers_microsoft_scl.yml | 8 ++++++++ .../headers/headers_mismatched_from_reply_to.yml | 7 +++++++ .../headers_mismatched_from_return_path.yml | 8 ++++++++ .../headers_phishing_simulation_cofense.yml | 16 ++++++++++++++++ .../headers_phishing_simulation_hoxhunt.yml | 4 ++++ .../headers_phishing_simulation_knowbe4.yml | 4 ++++ .../headers/headers_undisclosed_recipients.yml | 6 ++++++ signals/headers/headers_x_originating_ip.yml | 4 ++++ 13 files changed, 86 insertions(+) rename signals/{ => attachments}/attachment_count.yml (100%) rename signals/{ => attachments}/attachment_filesizes.yml (100%) create mode 100644 signals/content/body_tracking_pixel.yml create mode 100644 signals/headers/headers_fake_thread.yml create mode 100644 signals/headers/headers_gmail_autoforward.yml create mode 100644 signals/headers/headers_microsoft_scl.yml create mode 100644 signals/headers/headers_mismatched_from_reply_to.yml create mode 100644 signals/headers/headers_mismatched_from_return_path.yml create mode 100644 signals/headers/headers_phishing_simulation_cofense.yml create mode 100644 signals/headers/headers_phishing_simulation_hoxhunt.yml create mode 100644 signals/headers/headers_phishing_simulation_knowbe4.yml create mode 100644 signals/headers/headers_undisclosed_recipients.yml create mode 100644 signals/headers/headers_x_originating_ip.yml diff --git a/signals/attachment_count.yml b/signals/attachments/attachment_count.yml similarity index 100% rename from signals/attachment_count.yml rename to signals/attachments/attachment_count.yml diff --git a/signals/attachment_filesizes.yml b/signals/attachments/attachment_filesizes.yml similarity index 100% rename from signals/attachment_filesizes.yml rename to signals/attachments/attachment_filesizes.yml diff --git a/signals/content/body_tracking_pixel.yml b/signals/content/body_tracking_pixel.yml new file mode 100644 index 00000000000..63ea71b5eef --- /dev/null +++ b/signals/content/body_tracking_pixel.yml @@ -0,0 +1,13 @@ +name: "Tracking pixel in HTML body" +type: "query" +source: | + ( + // standard html + regex.contains(body.html.raw, + ']*?width="1(px)?"[^>]*?height="1(px)?"[^>]*?style="[^"]*(visibility:hidden|display:none)[^"]*"[^>]*?>' + ) + // handle quoted printable variants + or regex.contains(body.html.raw, + '' + ) + ) diff --git a/signals/headers/headers_fake_thread.yml b/signals/headers/headers_fake_thread.yml new file mode 100644 index 00000000000..4573126026c --- /dev/null +++ b/signals/headers/headers_fake_thread.yml @@ -0,0 +1,9 @@ +name: "Fake message thread" +type: "query" +source: | + type.inbound + and strings.istarts_with(subject.subject, "RE:") + and ( + length(headers.references) == 0 + or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To"))) + ) diff --git a/signals/headers/headers_gmail_autoforward.yml b/signals/headers/headers_gmail_autoforward.yml new file mode 100644 index 00000000000..b8e4abf63ba --- /dev/null +++ b/signals/headers/headers_gmail_autoforward.yml @@ -0,0 +1,7 @@ +name: "Gmail Auto-Forward" +type: "query" +source: | + any([headers.return_path.email], + strings.ilike(headers.return_path.local_part, "*+caf_=*") and type.inbound + ) + diff --git a/signals/headers/headers_microsoft_scl.yml b/signals/headers/headers_microsoft_scl.yml new file mode 100644 index 00000000000..6f501f14a24 --- /dev/null +++ b/signals/headers/headers_microsoft_scl.yml @@ -0,0 +1,8 @@ +name: "Microsoft SCL" +type: "query" +source: | + filter( + map(headers.hops, + map(filter(.fields, .name =~ "X-ms-exchange-organization-scl"), .value) + ), length(.) > 0 + ) diff --git a/signals/headers/headers_mismatched_from_reply_to.yml b/signals/headers/headers_mismatched_from_reply_to.yml new file mode 100644 index 00000000000..b6c05c0dace --- /dev/null +++ b/signals/headers/headers_mismatched_from_reply_to.yml @@ -0,0 +1,7 @@ +name: "Mismatched From and Reply-to Doms" +type: "query" +source: | + any(headers.reply_to, + length(headers.reply_to) > 0 + and all(headers.reply_to, .email.domain.root_domain != sender.email.domain.root_domain) + ) diff --git a/signals/headers/headers_mismatched_from_return_path.yml b/signals/headers/headers_mismatched_from_return_path.yml new file mode 100644 index 00000000000..4557ab04dad --- /dev/null +++ b/signals/headers/headers_mismatched_from_return_path.yml @@ -0,0 +1,8 @@ +name: "Mismatched From and Return-Path" +type: "query" +source: | + any([headers.return_path.email], + (headers.return_path.email is not null + and headers.return_path.email != sender.email.email + and type.inbound) + ) diff --git a/signals/headers/headers_phishing_simulation_cofense.yml b/signals/headers/headers_phishing_simulation_cofense.yml new file mode 100644 index 00000000000..1a6427e8350 --- /dev/null +++ b/signals/headers/headers_phishing_simulation_cofense.yml @@ -0,0 +1,16 @@ +name: "Cofense PhishMe phishing simulation" +type: "query" +source: | + any(headers.ips, .ip in ( + "13.113.166.58", + "35.182.57.68", + "52.1.96.230", + "52.20.128.29", + "52.20.155.14", + "52.28.182.143", + "52.28.252.18", + "52.29.24.224", + "52.29.5.79", + "52.5.119.169", + "52.62.59.61", + )) diff --git a/signals/headers/headers_phishing_simulation_hoxhunt.yml b/signals/headers/headers_phishing_simulation_hoxhunt.yml new file mode 100644 index 00000000000..97463d5042a --- /dev/null +++ b/signals/headers/headers_phishing_simulation_hoxhunt.yml @@ -0,0 +1,4 @@ +name: "HoxHunt phishing simulation" +type: "query" +source: | + any(headers.hops, strings.ends_with(.signature.domain, ".hoxhuntsigning.com")) diff --git a/signals/headers/headers_phishing_simulation_knowbe4.yml b/signals/headers/headers_phishing_simulation_knowbe4.yml new file mode 100644 index 00000000000..9fc45b7a381 --- /dev/null +++ b/signals/headers/headers_phishing_simulation_knowbe4.yml @@ -0,0 +1,4 @@ +name: "KnowBe4 phishing simulation" +type: "query" +source: | + any(headers.ips, regex.match(.ip, '147\.10\.167\.([0-9]|[0-5][0-9]|6[0-3])', '23.21.109.(197|212)', '52.49.(201.246|235.189)')) diff --git a/signals/headers/headers_undisclosed_recipients.yml b/signals/headers/headers_undisclosed_recipients.yml new file mode 100644 index 00000000000..0f2e86ad8f3 --- /dev/null +++ b/signals/headers/headers_undisclosed_recipients.yml @@ -0,0 +1,6 @@ +name: "Undisclosed Recipients" +type: "query" +source: | + any([recipients.to, recipients.bcc, recipients.cc], + any(., .display_name =~ "Undisclosed recipients:") + ) diff --git a/signals/headers/headers_x_originating_ip.yml b/signals/headers/headers_x_originating_ip.yml new file mode 100644 index 00000000000..07ee4ec53a1 --- /dev/null +++ b/signals/headers/headers_x_originating_ip.yml @@ -0,0 +1,4 @@ +name: "X-Originating-IP" +type: "query" +source: | + headers.x_originating_ip.ip